Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-31406

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() After cancel_delayed_work_sync() is called from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes remaining states via __xfrm_state_delete(), which calls xfrm_nat_keepalive_state_updated() to re-schedule nat_keepalive_work. The following is a simple race scenario: cpu0 cpu1 cleanup_net() [Round 1] ops_und
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f86e68443f0c81e6baa63736bb77409e4b35839cf5c5f32d010c0bcff4786f3a
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_nat_keepalive.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"32d0f44c2f14d60fe8e920e69a28c11051543ec1","status":"affected","version":"f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae","versionType":"git"},{"lessThan":"2255ed6adbc3100d2c4a83abd9d0396d04b87792","status":"affected","version":"f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae","versionType":"git"},{"lessThan":"21f2fc49ca6faa393c31da33b8a4e6c41fc84c13","status":"affected","version":"f531d13bdfe3f4f0…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_nat_keepalive.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_nat_keepalive.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"32d0f44c2f14d60fe8e920e69a28c11051543ec1","status":"affected","version":"f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae","versionType":"git"},{"lessThan":"2255ed6adbc3100d2c4a83abd9d0396d04b87792","status":"affected","version":"f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae","versionType":"git"},{"lessThan":"21f2fc49ca6faa393c31da33b8a4e6c41fc84c13","status":"affected","version":"f531d13bdfe3f4f0…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_nat_keepalive.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/metrics/0/cvssV3_1

Source references

4 source assertions
{"url":"https://git.kernel.org/stable/c/21f2fc49ca6faa393c31da33b8a4e6c41fc84c13"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/2255ed6adbc3100d2c4a83abd9d0396d04b87792"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/32d0f44c2f14d60fe8e920e69a28c11051543ec1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/daf8e3b253aa760ff9e96c7768a464bc1d6b3c90"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:04f6ee5561aa52402381f1b182f32253801d6f078db78c6c7666f535edb45aac · sha256:5a45041ea2c70fb2… · /containers/cna/references/3

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer