CVE-2026-31533 Linux CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those using TLS encryption, should be aware of this vulnerability and take immediate action to patch affected systems.

Technical summary

The vulnerability is caused by a use-after-free in the -EBUSY error path of tls_do_encryption(). When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to the cryptd backlog and the async callback tls_encrypt_done() will be invoked upon completion. However, if tls_encrypt_async_wait() returns an error, the synchronous error path in tls_do_encryption() performs the same cleanup again, double-decrementing encrypt_pending and double-restoring the scatterlist. This can lead to a use-after-free when a subsequent sendmsg frees the tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still pending.

Defensive priority

High

Recommended defensive actions

• Apply the official patches provided by the Linux kernel maintainers.
• Ensure that all Linux kernel-based systems are running with the latest kernel version.
• Monitor system logs for potential exploitation attempts.
• Implement additional security controls, such as network segmentation and access controls, to limit the attack surface.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was introduced by commit 859054147318 (net: tls: handle backlogging of crypto requests). The fix involves skipping the synchronous cleanup when the -EBUSY async wait returns an error.

Official resources