PT-2026-35138 · Linux · Linux

Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-31678

NVD

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: defer tunnel netdev put to RCU release

ovs netdev tunnel destroy() may run after NETDEV UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev.

Do not release vport->dev in ovs netdev tunnel destroy(). Instead, let vport netdev free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.

Related Identifiers

CVE-2026-31678

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-31678 · Security Note
• https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c · Note
• https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc · Note
• https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643 · Note
• https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896 · Note
• https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8 · Note
• https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab · Note