CVE-2026-31516
Use-After-Free in Linux Kernel XFRM Policy Workqueue During Netns Teardown
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 3.18 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 3.18.1 (inc) to 6.12.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's XFRM subsystem, specifically involving the handling of work items related to network namespaces.
A work item called policy_hthresh.work can be queued onto the system workqueue by a XFRM_MSG_NEWSPDINFO request. This work item eventually calls xfrm_hash_rebuild(), which accesses a network namespace structure (struct net) via container_of().
If the network namespace is torn down before this work item runs, the struct net it tries to access may have already been freed. This leads to a use-after-free condition where xfrm_hash_rebuild() dereferences stale memory, potentially causing undefined behavior or crashes.
The fix involves synchronizing the policy_hthresh.work during network namespace teardown to ensure the work cannot outlive the namespace and access freed memory.
How can this vulnerability impact me? :
This vulnerability can lead to the Linux kernel dereferencing freed memory, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.
Since it involves race conditions during network namespace teardown, systems using network namespaces extensively (such as containers or virtualized environments) may be more affected.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the fix has been applied. The fix involves synchronizing the policy_hthresh.work in xfrm_policy_fini() to prevent queued work from accessing freed memory after net namespace teardown.
Since the vulnerability is related to the Linux kernel's XFRM subsystem, applying the latest kernel patches or upgrading to a patched kernel version is the immediate recommended step.