CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown
In the Linux kernel, the following vulnerability has been resolved:
xfrm: prevent policyhthresh.work from racing with netns teardown
A XFRMMSGNEWSPDINFO request can queue the per-net work item policyhthresh.work onto the system workqueue.
The queued callback, xfrmhashrebuild(), retrieves the enclosing struct net via containerof(). If the net namespace is torn down before that work runs, the associated struct net may already have been freed, and xfrmhashrebuild() may then dereference stale memory.
xfrmpolicyfini() already flushes policyhashwork during teardown, but it does not synchronize policyhthresh.work.
Synchronize policyhthresh.work in xfrmpolicyfini() as well, so the queued work cannot outlive the net namespace teardown and access a freed struct net.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In xfrm_policy_fini(), synchronize/flush policy_hthresh.work during net namespace teardown so the queued callback xfrm_hash_rebuild() cannot dereference stale memory after the associated struct net has been freed.
Linux kernel xfrm_policy_fini() Synchronize policy_hthresh.work with net namespace teardown (flush before freeing) = Ensure policy_hthresh.work is synchronized/flushed in xfrm_policy_fini() (not just policy_hash_work)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31516?
CVE-2026-31516 has been classified with a severity level that may impact the stability of the Linux kernel.
How do I fix CVE-2026-31516?
To fix CVE-2026-31516, you should update to the latest patched version of the Linux kernel that addresses this vulnerability.
Who is affected by CVE-2026-31516?
CVE-2026-31516 affects users running vulnerable versions of the Linux kernel that utilize the XFRM subsystem.
What kind of attacks can CVE-2026-31516 help facilitate?
CVE-2026-31516 could be exploited to create race conditions that may lead to unexpected behavior during net namespace teardown.
When was CVE-2026-31516 reported?
CVE-2026-31516 was reported as part of ongoing security assessments of the Linux kernel.