CVE-2026-31469
published 2026-04-22CVE-2026-31469: In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
expects the driver to hold the reference to skb->dst until the packet
is fully transmitted and freed. In virtio_net with napi_tx=N,
skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending,
the corresponding dst_ops structure has freed. When a subsequent packet
is transmitted, free_old_xmit() is triggered to clean up old skbs.
It then calls dst_release() on the skb associated with the stale dst_entry.
Since the dst_ops (referenced by the dst_entry) has already been freed,
a UAF kernel paging request occurs.
fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
the dst reference before the skb is queued in virtio_net.
Call Trace:
Unable to handle kernel paging request at virtual address ffff80007e150000
CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
...
percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
dst_release+0xe0/0x110 net/core/dst.c:177
skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
__free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
...
Reproduction Steps:
NETDEV="enp3s0"
config_qdisc_route_filter() {
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio
tc filter add
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < be0e63f3b97bbaf453c542e8a15ba2a536e2ac01 | be0e63f3b97bbaf453c542e8a15ba2a536e2ac01 |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < c1ec36cb3768574b916f20d2d7415fd14fa1bf12 | c1ec36cb3768574b916f20d2d7415fd14fa1bf12 |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < 8a4790850e710fd6771e4d2112168ed1dd6c0e54 | 8a4790850e710fd6771e4d2112168ed1dd6c0e54 |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < fedd2e1630cac920844997227ccbe7b26a76375a | fedd2e1630cac920844997227ccbe7b26a76375a |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < f04733c4dc40c43899c3d1c97afbae5831a3770f | f04733c4dc40c43899c3d1c97afbae5831a3770f |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < 9a18629f2525781f0f3dda7be72b204e4cf77d08 | 9a18629f2525781f0f3dda7be72b204e4cf77d08 |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < 63d45077b97bb0e0fe0c75931acbbca7a47af141 | 63d45077b97bb0e0fe0c75931acbbca7a47af141 |
| linux | linux | >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < ba8bda9a0896746053aa97ac6c3e08168729172c | ba8bda9a0896746053aa97ac6c3e08168729172c |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.26 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.21 | 6.18.21 |
| linux | linux_kernel | >= 6.19 < 6.19.11 | 6.19.11 |
| linux | linux_kernel | >= 6.2 < 6.6.131 | 6.6.131 |
| linux | linux_kernel | >= 6.7 < 6.12.80 | 6.12.80 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.19.10 virtio_net lib/percpu_counter.c free_old_xmit use after free (Nessus ID 313522 / WID-SEC-2026-1252)
vuldb·2026-07-17·CVSS 7.8
CVE-2026-31469 [HIGH] Linux Kernel up to 6.19.10 virtio_net lib/percpu_counter.c free_old_xmit use after free (Nessus ID 313522 / WID-SEC-2026-1252)
A vulnerability was found in Linux Kernel up to 6.19.10 and classified as critical. This affects the function free_old_xmit in the library lib/percpu_counter.c of the component virtio_net. The manipulation results in use after free.
This vulnerability is identified as CVE-2026-31469. The attack can only be performed from the local network. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
GHSA-vggv-f293-vmjw: In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx i
ghsa_unreviewed·2026-04-22
CVE-2026-31469 GHSA-vggv-f293-vmjw: In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx i
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
expects the driver to hold the reference to skb->dst until the packet
is fully transmitted and freed. In virtio_net with napi_tx=N,
skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending,
the corresponding dst_ops structure has freed. When a subsequent packet
is transmitted, free_old_xmit
Red Hat
kernel: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
vendor_redhat·2026-04-22·CVSS 7.0
CVE-2026-31469 [MEDIUM] CWE-911 kernel: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
kernel: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
A flaw was found in the Linux kernel's virtio_net driver. A local user can trigger a Use-After-Free (UAF) vulnerability by configuring the driver with specific network settings and then destroying the network namespace while data packets are still being transmitted. This premature freeing of network resources, specifically the dst_ops structure, can lead to a kernel paging request, resulting in a system crash and a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kern
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/63d45077b97bb0e0fe0c75931acbbca7a47af141https://git.kernel.org/stable/c/8a4790850e710fd6771e4d2112168ed1dd6c0e54https://git.kernel.org/stable/c/9a18629f2525781f0f3dda7be72b204e4cf77d08https://git.kernel.org/stable/c/ba8bda9a0896746053aa97ac6c3e08168729172chttps://git.kernel.org/stable/c/be0e63f3b97bbaf453c542e8a15ba2a536e2ac01https://git.kernel.org/stable/c/c1ec36cb3768574b916f20d2d7415fd14fa1bf12https://git.kernel.org/stable/c/f04733c4dc40c43899c3d1c97afbae5831a3770fhttps://git.kernel.org/stable/c/fedd2e1630cac920844997227ccbe7b26a76375ahttps://cert-portal.siemens.com/productcert/html/ssa-019113.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
2026-04-22
Published