{"id":"CVE-2026-31516","revision":"db4cfef20b82440b994f3c7313c45132","records":[{"revision":"db4cfef20b82440b994f3c7313c45132","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31516","aliases":[],"title":"xfrm: prevent policy_hthresh.work from racing with netns teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: prevent policy_hthresh.work from racing with netns teardown\n\nA XFRM_MSG_NEWSPDINFO request can queue the per-net work item\npolicy_hthresh.work onto the system workqueue.\n\nThe queued callback, xfrm_hash_rebuild(), retrieves the enclosing\nstruct net via container_of(). If the net namespace is torn down\nbefore that work runs, the associated struct net may already have\nbeen freed, and xfrm_hash_rebuild() may then dereference stale memory.\n\nxfrm_policy_fini() already flushes policy_hash_work during teardown,\nbut it does not synchronize policy_hthresh.work.\n\nSynchronize policy_hthresh.work in xfrm_policy_fini() as well, so the\nqueued work cannot outlive the net namespace teardown and access a\nfreed struct net.","state":0,"publishedAt":"2026-04-22T13:54:32.851+00:00","modifiedAt":"2026-10-19T18:45:54.791+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/xfrm_policy.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"880a6fab8f6ba5b5abe59ea68533202ddea1012c\",\n                            \"lessThan\": \"56ea2257b83ee29a543f158159e3d1abc1e3e4fe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"880a6fab8f6ba5b5abe59ea68533202ddea1012c\",\n                            \"lessThan\": \"8854e9367465d784046362698731c1111e3b39b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"880a6fab8f6ba5b5abe59ea68533202ddea1012c\",\n                            \"lessThan\": \"4e2e77843fef473ef47e322d52436d8308582a96\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"880a6fab8f6ba5b5abe59ea68533202ddea1012c\",\n                            \"lessThan\": \"29fe3a61bcdce398ee3955101c39f89c01a8a77e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/xfrm_policy.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.80\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.21\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.11\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe","https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8","https://git.kernel.org/stable/c/4e2e77843fef473ef47e322d52436d8308582a96","https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31516","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31516","identifiers":["CVE-2026-31516"]},"retained":false,"historicalAffected":[]}],"coverage":[]}