PT-2026-34374 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-31469

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the virtio net driver when it is configured with napi tx=N and the IFF XMIT DST RELEASE flag is cleared, such as during the configuration of tc route filter rules. When this flag is removed, the network stack expects the driver to maintain the reference to skb->dst until the packet is transmitted and freed. If a network namespace is destroyed while packets are still pending in the virtio transmit ring, the dst ops structure is freed. A subsequent packet transmission triggers free old xmit(), which calls dst release() on the stale dst entry, leading to a kernel paging request because the referenced dst ops has already been freed.

Recommendations As a temporary workaround, consider restricting the use of the virtio net driver with napi tx=N when modifying tc route filter rules or managing network namespaces until a patch is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31469

ECHO-D532-C588-CF11

Affected Products

Linux Kernel

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2026-31469 · Security Note
• https://git.kernel.org/stable/c/63d45077b97bb0e0fe0c75931acbbca7a47af141 · Patch
• https://git.kernel.org/stable/c/8a4790850e710fd6771e4d2112168ed1dd6c0e54 · Patch
• https://git.kernel.org/stable/c/c1ec36cb3768574b916f20d2d7415fd14fa1bf12 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31469 · Security Note
• https://git.kernel.org/stable/c/fedd2e1630cac920844997227ccbe7b26a76375a · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31469 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31469 · Vendor Advisory
• https://git.kernel.org/stable/c/f04733c4dc40c43899c3d1c97afbae5831a3770f · Patch
• https://git.kernel.org/stable/c/9a18629f2525781f0f3dda7be72b204e4cf77d08 · Patch
• https://git.kernel.org/stable/c/ba8bda9a0896746053aa97ac6c3e08168729172c · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31469 · Vendor Advisory
• https://git.kernel.org/stable/c/be0e63f3b97bbaf453c542e8a15ba2a536e2ac01 · Patch
• https://ubuntu.com/security/CVE-2026-31469 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31469 · Vendor Advisory