CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race
In the Linux kernel, the following vulnerability has been resolved:
net: fix fanout UAF in packetrelease() via NETDEVUP race
packetrelease() has a race window where NETDEVUP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanoutrelease(), leaving a dangling pointer in the fanout array. packetrelease() does NOT zero po->num in its bindlock section. After releasing bindlock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packetnotifier(NETDEVUP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls fanoutlink(sk, po) which adds the socket back into f->arr[] and increments f->nummembers, but does NOT increment f->skref.
The fix sets po->num to zero in packetrelease while bindlock is held to prevent NETDEVUP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based on CVE-2025-38617.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.257-1Fixed in 6.1.170-3Fixed in 6.1.174-1Fixed in 6.12.86-1Fixed in 6.12.94-1Fixed in 7.0.12-2Fixed in 7.0.13-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.174-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31504?
CVE-2026-31504 has a severity rating that indicates it poses a risk due to its potential for use-after-free conditions in the Linux kernel.
How do I fix CVE-2026-31504?
To fix CVE-2026-31504, ensure that you update to a patched version of the Linux kernel that addresses the fanout UAF vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-31504?
CVE-2026-31504 affects specific versions of the Linux kernel that contain the vulnerability in the packet_release() function.
What kind of issues does CVE-2026-31504 cause?
CVE-2026-31504 can lead to system instability or security vulnerabilities due to improper management of memory in the packet socket handling.
Is CVE-2026-31504 exploitable remotely?
CVE-2026-31504 may be exploited remotely under certain conditions, depending on the network configurations and use of packet sockets.