CVE-2026-31504
Use-After-Free in Linux Kernel net Fanout via NETDEV_UP Race Condition
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 3.1 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 3.1.1 (inc) to 5.10.253 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.131 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's network code related to fanout sockets. Specifically, there is a race condition in the function packet_release() where a socket can be re-registered into a fanout group's array during a NETDEV_UP event. Because packet_release() does not properly reset certain fields (like po->num) while holding a lock, a concurrent NETDEV_UP event can cause the socket to be added back into the fanout array without proper reference counting. This results in a dangling pointer in the fanout array, which is a use-after-free (UAF) issue.
The fix involves setting po->num to zero while holding the bind_lock in packet_release() to prevent the race condition where NETDEV_UP can re-link the socket improperly.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel's networking stack. Such a condition may allow attackers to cause kernel crashes, leading to denial of service, or potentially execute arbitrary code with kernel privileges if exploited successfully. This can compromise the stability and security of the affected system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by setting the po->num field to zero in packet_release while the bind_lock is held, preventing the NETDEV_UP re-registration race condition.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.