PT-2026-35021 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-26 · CVE-2026-31669

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the inet lookup established() function. The problem occurs because MPTCP v6 subflow child sockets are allocated via kmalloc instead of the TCPv6 slab cache due to an initialization order error where tcpv6 prot override.slab remains NULL. Because the kmalloc-4k cache lacks the SLAB TYPESAFE BY RCU flag, memory can be reused immediately after being freed. Consequently, concurrent ehash lookups under rcu read lock may access freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31669

ECHO-E6A5-F9D1-FE42

Affected Products

Linux Kernel

References · 19

• https://git.kernel.org/stable/c/fb1f54b7d16f393b8b65d328410f78b4beea8fcc · Patch
• https://git.kernel.org/stable/c/f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31669 · Security Note
• https://git.kernel.org/stable/c/15fa9ead4d5e6b6b9c794e84144146c917f2cb62 · Patch
• https://git.kernel.org/stable/c/eb9c6aeb512f877cf397deb1e4526f646c70e4a7 · Patch
• https://git.kernel.org/stable/c/3fd6547f5b8ac99687be6d937a0321efda760597 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31669 · Vendor Advisory
• https://git.kernel.org/stable/c/b313e9037d98c13938740e5ebda7852929366dff · Patch
• https://ubuntu.com/security/CVE-2026-31669 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31669 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31669 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31669 · Vendor Advisory
• https://git.kernel.org/stable/c/9b55b253907e7431210483519c5ad711a37dafa1 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31669 · Vendor Advisory