PT-2026-34409 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31504

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the packet release() function where a NETDEV UP event can re-register a socket into a fanout group's arr[] array. Because packet release() does not zero the po->num variable while holding the bind lock, a concurrent packet notifier(NETDEV UP) can re-register the hook. For fanout sockets, this process calls fanout link(sk, po), which adds the socket back into f->arr[] and increments f->num members without incrementing f->sk ref. This results in a Use-After-Free (UAF) condition, which is a situation where a program continues to use a pointer after it has been freed, potentially leading to crashes or unauthorized memory access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31504

Affected Products

Linux Kernel

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-31504 · Security Note
• https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1 · Note
• https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66e · Note
• https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b · Note
• https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796 · Note
• https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e · Note
• https://twitter.com/CVEnew/status/2046979970967187767 · Twitter Post
• https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9 · Note
• https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b · Note
• https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6 · Note