CVE-2026-31664

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises because the build_polexpire() function does not clear trailing padding bytes within the xfrm_user_polexpire structure. Consequently, these uninitialized padding bytes, which contain kernel heap memory contents, are sent to userspace via netlink multicast. A local attacker could exploit this to disclose potentially sensitive information from kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.