AZL-83873
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-83873.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-83873
- Upstream
- Published
- 2026-04-24T15:16:46Z
- Modified
- 2026-08-28T17:48:03.364204395Z
- Summary
- CVE-2026-31664 affecting package kernel for versions less than 6.6.137.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
xfrm: clear trailing padding in build_polexpire()
buildexpire() clears the trailing padding bytes of struct xfrmuserexpire after setting the hard field via memsetafter(), but the analogous function buildpolexpire() does not do this for struct xfrmuser_polexpire.
The padding bytes after the _u8 hard field are left uninitialized from the heap allocation, and are then sent to userspace via netlink multicast to XFRMNLGRPEXPIRE listeners, leaking kernel heap memory contents.
Add the missing memsetafter() call, matching buildexpire().
- References