CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
In the Linux kernel, the following vulnerability has been resolved:
wireguard: device: use exitrtnl callback instead of manual rtnllock in preexit
wgnetnspreexit() manually acquires rtnllock() inside the pernet .preexit callback. This causes a hung task when another thread holds rtnlmutex - the cleanupnet workqueue (or the setupnet failure rollback path) blocks indefinitely in wgnetnspreexit() waiting to acquire the lock.
Convert to .exitrtnl, introduced in commit 7a60d91c690b ("net: Add ->exitrtnl() hook to struct pernetoperations."), where the framework already holds RTNL and batches all callbacks under a single rtnllock()/rtnlunlock() pair, eliminating the contention window.
The rcuassignpointer(wg->creatingnet, NULL) is safe to move from .preexit to .exitrtnl (which runs after synchronizercu()) because all RCU readers of creatingnet either use maybegetnet() - which returns NULL for a dying namespace with zero refcount - or access net->userns which remains valid throughout the entire opsundolist sequence.
[ Jason: added netexit and readmostly annotations that were missing. ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-27.27 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1 - Compensating control
Update WireGuard kernel namespace cleanup so wg_netns_pre_exit() no longer manually acquires rtnl_lock(); move the rcu_assign_pointer(wg->creating_net, NULL) operation to the pernet .exit_rtnl callback, which runs after synchronize_rcu() while the framework holds RTNL.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31579?
CVE-2026-31579 is classified as a medium severity vulnerability within the Linux kernel's wireguard implementation.
How do I fix CVE-2026-31579?
To address CVE-2026-31579, update your Linux kernel to a version that includes the fix, specifically versions 6.18.24 or newer.
Which versions of the Linux kernel are affected by CVE-2026-31579?
CVE-2026-31579 affects versions of the Linux kernel prior to 6.18.24, and also versions between 6.19 and 6.19.14 and between 7.0 and 7.0.1.
What component of the Linux kernel is impacted by CVE-2026-31579?
CVE-2026-31579 specifically impacts the wireguard device functionality in the Linux kernel.
Is CVE-2026-31579 a privilege escalation vulnerability?
No, CVE-2026-31579 does not represent a privilege escalation vulnerability but rather involves incorrect usage of the rtnl_lock mechanism.