In the Linux kernel, the following vulnerability has been resolved:
xfrm: prevent policy_hthresh.work from racing with netns teardown
A XFRM_MSG_NEWSPDINFO request can queue the per-net work item
policy_hthresh.work onto the system workqueue.
The queued callback, xfrm_hash_rebuild(), retrieves the enclosing
struct net via container_of(). If the net namespace is torn down
before that work runs, the associated struct net may already have
been freed, and xfrm_hash_rebuild() may then dereference stale memory.
xfrm_policy_fini() already flushes policy_hash_work during teardown,
but it does not synchronize policy_hthresh.work.
Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the
queued work cannot outlive the net namespace teardown and access a
freed struct net.
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e - Patch | |
| References | () https://git.kernel.org/stable/c/4e2e77843fef473ef47e322d52436d8308582a96 - Patch | |
| References | () https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe - Patch | |
| References | () https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
|
| CWE | CWE-362 | |
| First Time |
Linux
Linux linux Kernel |
27 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-04-28 16:30
NVD link : CVE-2026-31516
Mitre link : CVE-2026-31516
CVE.ORG link : CVE-2026-31516
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')