CVE-2026-31695
Use-After-Free in Linux Kernel virt_wifi Driver
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.22 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.12 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.81 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.134 (exc) |
| linux | linux_kernel | From 5.15 (inc) to 5.15.203 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's virt_wifi network devices. It involves a use-after-free bug caused by the execution of the SET_NETDEV_DEV macro, which sets a device pointer that can become invalid during device unregistration. Specifically, when a virt_wifi device is being unregistered, the device referenced by SET_NETDEV_DEV may be freed, but operations like ethtool can still access this freed memory, leading to a use-after-free condition.
The issue arises because the dev.parent field of the virt_wifi device can point to freed memory, and functions such as ethnl_ops_begin() call pm_runtime_get_sync() on this invalid pointer, causing memory safety violations.
The fix involved removing the SET_NETDEV_DEV call for virt_wifi devices to prevent these use-after-free bugs.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free memory errors in the Linux kernel when performing operations on virt_wifi devices that are being unregistered. Such memory errors can cause system instability, crashes, or potentially allow attackers to execute arbitrary code or escalate privileges if they can trigger these conditions.
Because it involves kernel memory corruption, it may compromise the reliability and security of systems using affected Linux kernel versions with virt_wifi devices.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a use-after-free bug in the Linux kernel's virt_wifi net devices during ethtool operations. Detection would typically involve monitoring for kernel warnings or errors related to use-after-free conditions, such as KASAN (Kernel Address Sanitizer) reports.
You can check your system logs (e.g., dmesg or journalctl) for messages indicating KASAN slab-use-after-free errors related to __pm_runtime_resume or ethnl_ops_begin.
Example commands to detect such issues include:
- dmesg | grep -i kasan
- journalctl -k | grep -i kasan
- ethtool <virt_wifi_device> to trigger ethtool operations and observe if any kernel errors occur.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by removing the SET_NETDEV_DEV call for virt_wifi devices to avoid use-after-free bugs during device unregistration.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix removing SET_NETDEV_DEV for virt_wifi devices.
- Avoid performing ethtool operations on virt_wifi devices that may be in the process of being unregistered.
- Monitor kernel logs for related errors and avoid using affected kernel versions in production environments.