CVE-2026-31695: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
In the Linux kernel, the following vulnerability has been resolved:
wifi: virtwifi: remove SETNETDEVDEV to avoid use-after-free
Currently we execute SETNETDEVDEV(dev, &priv->lowerdev->dev) for the virtwifi net devices. However, unregistering a virtwifi device in netdevruntodo() can happen together with the device referenced by SETNETDEVDEV().
It can result in use-after-free during the ethtool operations performed on a virtwifi device that is currently being unregistered. Such a net device can have the dev.parent field pointing to the freed memory, but ethnlopsbegin() calls pmruntimegetsync(dev->dev.parent).
Let's remove SETNETDEVDEV for virtwifi to avoid bugs like this:
================================================================== BUG: KASAN: slab-use-after-free in pmruntimeresume+0xe2/0xf0 Read of size 2 at addr ffff88810cfc46f8 by task pm/606
Call Trace: <TASK> dumpstacklvl+0x4d/0x70 printreport+0x170/0x4f3 ? pfxrawspinlockirqsave+0x10/0x10 kasanreport+0xda/0x110 ? pmruntimeresume+0xe2/0xf0 ? pmruntimeresume+0xe2/0xf0 pmruntimeresume+0xe2/0xf0 ethnlopsbegin+0x49/0x270 ethnlsetfeatures+0x23c/0xab0 ? pfxethnlsetfeatures+0x10/0x10 ? kvmschedclockread+0x11/0x20 ? localclocknoinstr+0xf/0xf0 ? localclock+0x10/0x30 ? kasansavetrack+0x25/0x60 ? kasankmalloc+0x7f/0x90 ? genlfamilyrcvmsgattrsparse.isra.0+0x150/0x2c0 genlfamilyrcvmsgdoit+0x1e7/0x2c0 ? pfxgenlfamilyrcvmsgdoit+0x10/0x10 ? pfxcredhascapability.isra.0+0x10/0x10 ? stacktracesave+0x8e/0xc0 genlrcvmsg+0x411/0x660 ? pfxgenlrcvmsg+0x10/0x10 ? pfxethnlsetfeatures+0x10/0x10 netlinkrcvskb+0x121/0x380 ? pfxgenlrcvmsg+0x10/0x10 ? pfxnetlinkrcvskb+0x10/0x10 ? pfxdownread+0x10/0x10 genlrcv+0x23/0x30 netlinkunicast+0x60f/0x830 ? pfxnetlinkunicast+0x10/0x10 ? pfxallocskb+0x10/0x10 netlinksendmsg+0x6ea/0xbc0 ? pfxnetlinksendmsg+0x10/0x10 ? futexqueue+0x10b/0x1f0 syssendmsg+0x7a2/0x950 ? copymsghdrfromuser+0x26b/0x430 ? pfxsyssendmsg+0x10/0x10 ? pfxcopymsghdrfromuser+0x10/0x10 syssendmsg+0xf8/0x180 ? pfxsyssendmsg+0x10/0x10 ? pfxfutexwait+0x10/0x10 ? fdget+0x2e4/0x4a0 syssendmsg+0x11f/0x1c0 ? pfxsyssendmsg+0x10/0x10 dosyscall64+0xe2/0x570 ? excpagefault+0x66/0xb0 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>
This fix may be combined with another one in the ethtool subsystem: https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the virt_wifi driver, remove the call to SET_NETDEV_DEV(dev, &priv->lowerdev->dev) to avoid use-after-free during ethtool/netlink operations while the virt_wifi device is being unregistered.
Linux kernel virt_wifi driver SET_NETDEV_DEV(dev, &priv->lowerdev->dev) = removed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31695?
CVE-2026-31695 is classified as a high-severity vulnerability due to its potential to cause a use-after-free condition in the Linux kernel.
How do I fix CVE-2026-31695?
To fix CVE-2026-31695, update your Linux kernel to a patched version that addresses the use-after-free vulnerability.
What systems are affected by CVE-2026-31695?
CVE-2026-31695 affects Linux kernel versions between 5.15 and 7.0-rc7 that utilize virt_wifi network devices.
What is the impact of CVE-2026-31695?
The impact of CVE-2026-31695 includes potential denial of service and unauthorized access caused by the use-after-free error.
Is there a workaround for CVE-2026-31695 before patching?
Currently, no official workarounds are recommended for CVE-2026-31695, so applying the latest kernel updates is advised.