PT-2026-30574 · Linux · Linux

Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-31406

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the xfrm subsystem related to the handling of delayed work cancellation in xfrm nat keepalive net fini(). Specifically, the use of cancel delayed work sync() could lead to a race condition where a delayed work item (nat keepalive work) is rescheduled after the associated network structure (net) has been freed. This can result in the delayed work function being executed on freed memory, potentially leading to a system crash or other unpredictable behavior. The issue arises from the interaction between xfrm nat keepalive net fini(), xfrm state fini(), xfrm state delete(), and xfrm nat keepalive state updated(). The problem was addressed by replacing cancel delayed work sync() with disable delayed work sync().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31406

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-31406 · Security Note
• https://twitter.com/infoflowcloud/status/2041077634780581947 · Twitter Post
• https://twitter.com/CVEnew/status/2041076957555593579 · Twitter Post
• https://git.kernel.org/stable/c/21f2fc49ca6faa393c31da33b8a4e6c41fc84c13 · Note
• https://git.kernel.org/stable/c/2255ed6adbc3100d2c4a83abd9d0396d04b87792 · Note
• https://git.kernel.org/stable/c/32d0f44c2f14d60fe8e920e69a28c11051543ec1 · Note
• https://git.kernel.org/stable/c/daf8e3b253aa760ff9e96c7768a464bc1d6b3c90 · Note