CVE-2026-31504net: fix fanout UAF in packet_release() via NETDEV_UP race
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the socket in `sklist` can re-register the hook. For fanout sockets, this re-registration calls `__fanout_link(sk, po)` which adds the socket back into `f->arr[]` and increments `f->num_members`, but does NOT increment `f->sk_ref`. The fix sets `po->num` to zero in `packet_release` while `bind_lock` is held to prevent NETDEV_UP from linking, preventing the race window. This bug was found following an additional audit with Claude Code based on CVE-2025-38617.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before ee642b1962caa9aa231c01abbd58bc453ae6b66e; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 42cfd7898eeed290c9fb73f732af1f7d6b0a703e; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 1b4c03f8892d955385c202009af7485364731bb9; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 654386baef228c2992dbf604c819e4c7c35fc71b; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 75fe6db23705a1d55160081f7b37db9665b1880b; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before ceccbfc6de720ad633519a226715989cfb065af1; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 42156f93d123436f2a27c468f18c966b7e5db796 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 3.1.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 3.1; and 7 more ranges | NVD |
References
- https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66epatch
- https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703epatch
- https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9patch
- https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71bpatch
- https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880bpatch
- https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6patch
- https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1patch
- https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796patch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.