In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
Add validation of the inner IPv4 packet tot_len and ihl fields parsed
from decrypted IPTFS payloads in __input_process_payload(). A crafted
ESP packet containing an inner IPv4 header with tot_len=0 causes an
infinite loop: iplen=0 leads to capturelen=min(0, remaining)=0, so the
data offset never advances and the while(data < tail) loop never
terminates, spinning forever in softirq context.
Reject inner IPv4 packets where tot_len < ihl*4 or ihl*4 < sizeof(struct
iphdr), which catches both the tot_len=0 case and malformed ihl values.
The normal IP stack performs this validation in ip_rcv_core(), but IPTFS
extracts and processes inner packets before they reach that layer.
References
Configurations
Configuration 1 (hide)
|
History
27 Apr 2026, 23:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/0d10393d5eac33cbd92f7a41fddca12c41d3cb7e - Patch | |
| References | () https://git.kernel.org/stable/c/3db7d4f777a00164582061ccaa99569cd85011a3 - Patch | |
| References | () https://git.kernel.org/stable/c/de6d8e8ce5187f7402c9859b443355e7120c5f09 - Patch | |
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-835 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-04-27 23:28
NVD link : CVE-2026-31472
Mitre link : CVE-2026-31472
CVE.ORG link : CVE-2026-31472
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')