High 7.8Published Apr 22, 2026

CVE-2026-31504net: fix fanout UAF in packet_release() via NETDEV_UP race

Updated under an hour ago (Oct 27, 2026, 12:40 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the socket in `sklist` can re-register the hook. For fanout sockets, this re-registration calls `__fanout_link(sk, po)` which adds the socket back into `f->arr[]` and increments `f->num_members`, but does NOT increment `f->sk_ref`. The fix sets `po->num` to zero in `packet_release` while `bind_lock` is held to prevent NETDEV_UP from linking, preventing the race window. This bug was found following an additional audit with Claude Code based on CVE-2025-38617.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before ee642b1962caa9aa231c01abbd58bc453ae6b66e; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 42cfd7898eeed290c9fb73f732af1f7d6b0a703e; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 1b4c03f8892d955385c202009af7485364731bb9; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 654386baef228c2992dbf604c819e4c7c35fc71b; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 75fe6db23705a1d55160081f7b37db9665b1880b; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before ceccbfc6de720ad633519a226715989cfb065af1; from ce06b03e60fc19c680d1bf873e779bf11c2fc518 before 42156f93d123436f2a27c468f18c966b7e5db796	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.1.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 3.1; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66e	patch
https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e	patch
https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9	patch
https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b	patch
https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b	patch
https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6	patch
https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1	patch
https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.