UBUNTU-CVE-2026-31579: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wireguard: device: use exitrtnl callback instead of manual rtnllock in preexit wgnetnspreexit() manually acquires rtnllock() inside the pernet .preexit callback. This causes a hung task when another thread holds rtnlmutex - the cleanupnet workqueue (or the setupnet failure rollback path) blocks indefinitely in wgnetnspreexit() waiting to acquire the lock. Convert to .exitrtnl, introduced in commit 7a60d91c690b ("net: Add ->exitrtnl() hook to struct pernetoperations."), where the framework already holds RTNL and batches all callbacks under a single rtnllock()/rtnlunlock() pair, eliminating the contention window. The rcuassignpointer(wg->creatingnet, NULL) is safe to move from .preexit to .exitrtnl (which runs after synchronizercu()) because all RCU readers of creatingnet either use maybegetnet() - which returns NULL for a dying namespace with zero refcount - or access net->userns which remains valid throughout the entire opsundolist sequence. [ Jason: added netexit and readmostly annotations that were missing. ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-27.27 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1 - Compensating control
Update WireGuard device namespace cleanup to use the pernet .exit_rtnl callback instead of wg_netns_pre_exit() manually acquiring rtnl_lock(); move rcu_assign_pointer(wg->creating_net, NULL) to .exit_rtnl, which runs after synchronize_rcu().