CVE-2026-31518

esp: fix skb leak with espintcp and async crypto

State: Published
Severity: Not scored
Published: Apr 22, 2026
Updated: Oct 15, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

esp: fix skb leak with espintcp and async crypto

When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us.

With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before aca3ad0c262f54a5b5c95dda80a48365997d1224Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 41aafca57de4a4c026701622bd4648f112a9edcdAffected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4820847e036ff1035b01b69ad68dfc17e7028fe9Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 6a3ec6efbc4f90e0ccb2e71574f07351f19996f4Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before df6f995358dc1f3c42484f5cfe241d7bd3e1cd15Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 88d386243ed374ac969dabd3bbc1409a31d81818Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 6aa9841d917532d0f2d932d1ff2f3a94305aaf47Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before aca3ad0c262f54a5b5c95dda80a48365997d1224Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 41aafca57de4a4c026701622bd4648f112a9edcdAffected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4820847e036ff1035b01b69ad68dfc17e7028fe9Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 6a3ec6efbc4f90e0ccb2e71574f07351f19996f4Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before df6f995358dc1f3c42484f5cfe241d7bd3e1cd15Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 88d386243ed374ac969dabd3bbc1409a31d81818Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 6aa9841d917532d0f2d932d1ff2f3a94305aaf47Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.