Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31472— xfrm: iptfs: validate inner IPv4 header length in IPTFS payload

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未验证IPTFS负载中的内部IPv4包头长度，可能导致tot_len=0时无限循环。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.16% · P5

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 6c82d2433671819a550227bf65bfb6043e3d3305< de6d8e8ce5187f7402c9859b443355e7120c5f09 affected
6c82d2433671819a550227bf65bfb6043e3d3305< 3db7d4f777a00164582061ccaa99569cd85011a3 affected
6c82d2433671819a550227bf65bfb6043e3d3305< 0d10393d5eac33cbd92f7a41fddca12c41d3cb7e affected
6.14 affected
< 6.14 unaffected
6.18.21≤ 6.18.* unaffected
6.19.11≤ 6.19.* unaffected
7.0≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31472

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: validate inner IPv4 header length in IPTFS payload Add validation of the inner IPv4 packet tot_len and ihl fields parsed from decrypted IPTFS payloads in __input_process_payload(). A crafted ESP packet containing an inner IPv4 header with tot_len=0 causes an infinite loop: iplen=0 leads to capturelen=min(0, remaining)=0, so the data offset never advances and the while(data < tail) loop never terminates, spinning forever in softirq context. Reject inner IPv4 packets where tot_len < ihl*4 or ihl*4 < sizeof(struct iphdr), which catches both the tot_len=0 case and malformed ihl values. The normal IP stack performs this validation in ip_rcv_core(), but IPTFS extracts and processes inner packets before they reach that layer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未验证IPTFS负载中的内部IPv4包头长度，可能导致tot_len=0时无限循环。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6c82d2433671819a550227bf65bfb6043e3d3305 ~ de6d8e8ce5187f7402c9859b443355e7120c5f09 -
Linux Linux 6.14 -

II. Public POCs for CVE-2026-31472

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31472

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-22 · 100 CVEs total

CVE-2026-31463 9.8 CRITICAL iomap: fix invalid folio access when i_blkbits differs from I/O granularity
CVE-2026-31444 9.8 CRITICAL ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
CVE-2026-31501 9.8 CRITICAL net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
CVE-2026-31478 9.8 CRITICAL ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
CVE-2026-31436 9.8 CRITICAL dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
CVE-2026-31448 9.4 CRITICAL ext4: avoid infinite loops caused by residual data
CVE-2026-31435 8.8 HIGH netfs: Fix read abandonment during retry
CVE-2026-31433 8.8 HIGH ksmbd: fix potencial OOB in get_file_all_info() for compound requests
CVE-2026-31432 8.8 HIGH ksmbd: fix OOB write in QUERY_INFO for compound requests
CVE-2026-31450 8.8 HIGH ext4: publish jinode after initialization
CVE-2026-31476 8.2 HIGH ksmbd: do not expire session on binding failure
CVE-2026-31464 8.1 HIGH scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
CVE-2026-31513 8.1 HIGH Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
CVE-2026-31504 7.8 HIGH net: fix fanout UAF in packet_release() via NETDEV_UP race
CVE-2026-31502 7.8 HIGH team: fix header_ops type confusion with non-Ethernet ports
CVE-2026-31431 7.8 HIGH crypto: algif_aead - Revert to operating out-of-place
CVE-2026-31449 7.8 HIGH ext4: validate p_idx bounds in ext4_ext_correct_indexes
CVE-2026-31505 7.8 HIGH iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
CVE-2026-31490 7.8 HIGH drm/xe/pf: Fix use-after-free in migration restore
CVE-2026-31479 7.8 HIGH drm/xe: always keep track of remap prev/next

Showing top 20 of 100 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31472

No comments yet

Leave a comment