CVE-2026-31515

A flaw was found in the Linux kernel. The pfkey_send_migrate function, which manages security associations, does not properly validate address families. This oversight can lead to an overfill of the socket buffer (skb), a data structure used for network packets, when processing certain requests. A local user could exploit this vulnerability to trigger a kernel crash, resulting in a Denial of Service (DoS) for the affected system.

Upstream validates PF_KEY migrate families early to prevent skb_put() overruns from truncated family fields. Red Hat treats this as a local DoS in the AF_KEY/IPsec management path. Apply kernel errata; unloading af_key may be possible where IP_KEY sockets are unused (often impractical on VPN nodes).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.