{"id":"CVE-2026-31504","revision":"978edd9616b14da1a33f2d3863243823","records":[{"revision":"978edd9616b14da1a33f2d3863243823","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31504","aliases":[],"title":"net: fix fanout UAF in packet_release() via NETDEV_UP race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group's `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po->num` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f->arr[]` and increments `f->num_members`,\nbut does NOT increment `f->sk_ref`.\n\nThe fix sets `po->num` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617.","state":0,"publishedAt":"2026-04-22T13:54:23.862+00:00","modifiedAt":"2026-10-19T18:45:53.946+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/packet/af_packet.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"ee642b1962caa9aa231c01abbd58bc453ae6b66e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"42cfd7898eeed290c9fb73f732af1f7d6b0a703e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"1b4c03f8892d955385c202009af7485364731bb9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"654386baef228c2992dbf604c819e4c7c35fc71b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"75fe6db23705a1d55160081f7b37db9665b1880b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"ceccbfc6de720ad633519a226715989cfb065af1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce06b03e60fc19c680d1bf873e779bf11c2fc518\",\n                            \"lessThan\": \"42156f93d123436f2a27c468f18c966b7e5db796\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/packet/af_packet.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.131\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.80\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.21\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.11\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66e","https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e","https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9","https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b","https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b","https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6","https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1","https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31504","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31504","identifiers":["CVE-2026-31504"]},"retained":false,"historicalAffected":[]}],"coverage":[]}