A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises because the `build_polexpire()` function does not clear trailing padding bytes within the `xfrm_user_polexpire` structure. Consequently, these uninitialized padding bytes, which contain kernel heap memory contents, are sent to userspace via netlink multicast. A local attacker could exploit this to disclose potentially sensitive information from kernel memory.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-31664 https://nvd.nist.gov/vuln/detail/CVE-2026-31664 https://lore.kernel.org/linux-cve-announce/2026042405-CVE-2026-31664-d315@gregkh/T