CVE-2026-31533 Linux CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those using TLS encryption, should be aware of this vulnerability and take immediate action to patch affected systems.

Technical summary

The vulnerability is caused by a use-after-free in the -EBUSY error path of tls_do_encryption(). When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to the cryptd backlog and the async callback tls_encrypt_done() will be invoked upon completion. However, if tls_encrypt_async_wait() returns an error, the synchronous error path in tls_do_encryption() performs the same cleanup again, double-decrementing encrypt_pending and double-restoring the scatterlist. This can lead to a use-after-free when a subsequent sendmsg frees the tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still pending.

Defensive priority

High

Recommended defensive actions

• Apply the official patches provided by the Linux kernel maintainers.
• Ensure that all Linux kernel-based systems are running with the latest kernel version.
• Monitor system logs for potential exploitation attempts.
• Implement additional security controls, such as network segmentation and access controls, to limit the attack surface.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was introduced by commit 859054147318 (net: tls: handle backlogging of crypto requests). The fix involves skipping the synchronous cleanup when the -EBUSY async wait returns an error.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.