In the Linux kernel, the following vulnerability has been resolved:
net: fix fanout UAF in packet_release() via NETDEV_UP race
`packet_release()` has a race window where `NETDEV_UP` can re-register a
socket into a fanout group's `arr[]` array. The re-registration is not
cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout
array.
`packet_release()` does NOT zero `po->num` in its `bind_lock` section.
After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`
still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`
that already found the socket in `sklist` can re-register the hook.
For fanout sockets, this re-registration calls `__fanout_link(sk, po)`
which adds the socket back into `f->arr[]` and increments `f->num_members`,
but does NOT increment `f->sk_ref`.
The fix sets `po->num` to zero in `packet_release` while `bind_lock` is
held to prevent NETDEV_UP from linking, preventing the race window.
This bug was found following an additional audit with Claude Code based
on CVE-2025-38617.
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 15:07
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.1:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
|
| References | () https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9 - Patch | |
| References | () https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796 - Patch | |
| References | () https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e - Patch | |
| References | () https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b - Patch | |
| References | () https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b - Patch | |
| References | () https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1 - Patch | |
| References | () https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6 - Patch | |
| References | () https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66e - Patch | |
| CWE | CWE-416 |
27 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-04-28 15:07
NVD link : CVE-2026-31504
Mitre link : CVE-2026-31504
CVE.ORG link : CVE-2026-31504
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free