CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: defer tunnel netdevput to RCU release
ovsnetdevtunneldestroy() may run after NETDEVUNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev.
Do not release vport->dev in ovsnetdevtunneldestroy(). Instead, let vportnetdevfree() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31678?
CVE-2026-31678 is classified with a severity that warrants immediate attention due to its impact on the stability of the Open vSwitch network functionality.
How do I fix CVE-2026-31678?
To fix CVE-2026-31678, it is recommended to update to the latest version of Open vSwitch where the vulnerability has been resolved.
What components are affected by CVE-2026-31678?
CVE-2026-31678 affects the Open vSwitch component within the Linux kernel.
What potential risks are associated with CVE-2026-31678?
The risks associated with CVE-2026-31678 include potential instability and unexpected behavior in network device management for Open vSwitch.
Who is affected by CVE-2026-31678?
Any organization or individual using Open vSwitch may be affected by CVE-2026-31678 due to its impact on network operations.