CVE-2026-31406
Race Condition in Linux Kernel xfrm_nat_keepalive Causes Use-After-Free
Publication date: 2026-04-06
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's xfrm subsystem related to network state cleanup and delayed work scheduling.
During the cleanup process of network resources, a race condition occurs where a delayed work task (nat_keepalive_work) is canceled and then rescheduled after the associated network state has been freed.
Specifically, after cancel_delayed_work_sync() is called to cancel the delayed work, the system flushes remaining states and then inadvertently reschedules the delayed work. This can lead to the delayed work running on a freed network structure, causing potential use-after-free issues.
The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() to prevent the rescheduling of the delayed work after cancellation, thus avoiding the race condition.
How can this vulnerability impact me? :
This vulnerability can lead to a race condition where delayed work is executed on freed network resources.
Such a scenario can cause use-after-free errors, which may result in system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by replacing cancel_delayed_work_sync() with disable_delayed_work_sync() in the affected Linux kernel code. Therefore, the immediate mitigation step is to update your Linux kernel to a version that includes this fix.