CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
ip6flseqshow() walks the global flowlabel hash under the seq-file RCU read-side lock and prints fl->opt->optnflen when an option block is present.
Exclusive flowlabels currently free fl->opt as soon as fl->users drops to zero in flrelease(). However, the surrounding struct ip6flowlabel remains visible in the global hash table until later garbage collection removes it and flfreercu() finally tears it down.
A concurrent /proc/net/ip6flowlabel reader can therefore race that early kfree() and dereference freed option state, triggering a crash in ip6flseqshow().
Fix this by keeping fl->opt alive until flfreercu(). That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31680?
CVE-2026-31680 has a moderate severity rating due to potential impact on network functionality.
How do I fix CVE-2026-31680?
To mitigate CVE-2026-31680, update to the latest patched version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-31680?
CVE-2026-31680 affects the Linux kernel, specifically systems utilizing IPv6 networking.
What are the potential impacts of CVE-2026-31680?
CVE-2026-31680 could lead to crashes or instabilities in IPv6 flowlabel handling within the kernel.
Is CVE-2026-31680 being actively exploited?
As of now, there are no reports indicating that CVE-2026-31680 is being actively exploited in the wild.