CVE-2026-31515

In the Linux kernel, the following vulnerability has been resolved:

afkey: validate families in pfkeysend_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkeysendmigrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skboverpanic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skboverpanic net/core/skbuff.c:219 [inline] skbput+0x159/0x210 net/core/skbuff.c:2655 skbputzero include/linux/skbuff.h:2788 [inline] setipsecrequest net/key/afkey.c:3532 [inline] pfkeysendmigrate+0x1270/0x2e50 net/key/afkey.c:3636 kmmigrate+0x155/0x260 net/xfrm/xfrmstate.c:2848 xfrmmigrate+0x2140/0x2450 net/xfrm/xfrmpolicy.c:4705 xfrmdomigrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150