CVE-2026-31508
Use-After-Free Vulnerability in Linux Kernel Open vSwitch Component
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.6.120 (inc) to 6.6.131 (exc) |
| linux | linux_kernel | From 6.19.1 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 5.10.248 (inc) to 5.10.253 (exc) |
| linux | linux_kernel | From 5.15.198 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 6.1.160 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.12.64 (inc) to 6.12.80 (exc) |
| linux | linux_kernel | From 6.18.4 (inc) to 6.18.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Open vSwitch (OVS) network component. It involves the improper handling of network device teardown, where the network device (netdev) can be released before the teardown process is fully completed.
Specifically, the issue arises because the ovs_netdev_detach_dev() function clears a flag (IFF_OVS_DATAPATH) before the device unregistration finishes. If the system is preempted at this point (which can happen on real-time kernels), the netdev_destroy() callback may proceed and free the device prematurely. This leads to a general protection fault (kernel crash) due to accessing freed memory.
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash (general protection fault) in systems running the affected Linux kernel with Open vSwitch. Such crashes can lead to system instability, downtime, and potential loss of network connectivity.
In environments relying on Open vSwitch for network virtualization or traffic management, this could disrupt services, affect availability, and require system reboots to recover.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a general protection fault (kernel crash) related to the Open vSwitch (OVS) network device teardown process in the Linux kernel. Detection involves monitoring system logs for kernel oops or crash messages similar to the provided stack trace, especially messages referencing 'dev_set_promiscuity', 'ovs_netdev_detach_dev', or 'openvswitch'.
You can check your system logs (e.g., /var/log/kern.log, /var/log/messages, or use the journalctl command) for kernel oops or panic messages related to Open vSwitch.
- Use the command: sudo journalctl -k | grep -i 'openvswitch\|dev_set_promiscuity\|general protection fault'
- Check dmesg output for recent kernel errors: dmesg | grep -i 'openvswitch\|dev_set_promiscuity\|Oops'
- Verify if the affected Open vSwitch version or kernel version is in use by running: uname -r and ovs-vsctl --version
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to apply the patch that fixes the teardown code for Open vSwitch ports in the Linux kernel, which prevents the premature release of network devices during unregistration.
Until the patch is applied, consider the following immediate steps:
- Avoid using or restarting Open vSwitch ports or interfaces on affected kernel versions to reduce the chance of triggering the bug.
- Monitor system stability and logs closely for signs of kernel crashes related to this issue.
- Plan and perform a kernel upgrade to a version that includes the fix for this vulnerability as soon as possible.