Linux kernel (net/xfrm): One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path into

CVSS 7.5CVE-2026-31472Kernel, userspace & hypervisorcurated

Impact

One crafted inner IPv4 header (tot_len = 0) inside an IPTFS payload puts the receive path into an infinite loop in softirq context. The CPU never leaves the loop, so a single packet takes a core out permanently and wedges packet processing on the node - a fabric-wide stall and an outage for every tenant sharing that host, from one packet, repeatable at will.

Who can reach it

The malformed header is inside the decrypted IPTFS payload, so the sender must be a valid peer on the SA - a peer node on the cluster fabric, a compromised node, or a tenant endpoint terminating an overlay tunnel whose key the tenant holds. Conditional on IPTFS mode being configured. No local access to the victim node is required; the inner header never reaches ip_rcv_core, which is where this validation normally happens.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published in the record). Interim control: stop terminating tenant-controlled or untrusted IPTFS tunnels on shared nodes, and drop IP-TFS mode in favour of plain ESP tunnel mode until patched.

References

https://git.kernel.org/stable/c/de6d8e8ce5187f7402c9859b443355e7120c5f09 https://git.kernel.org/stable/c/3db7d4f777a00164582061ccaa99569cd85011a3 https://nvd.nist.gov/vuln/detail/CVE-2026-31472

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.