PT-2026-35140 · Linux · Linux Kernel

Published 2026-04-25 · Updated 2026-05-26 · CVE-2026-31680

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the IPv6 flowlabel implementation. The function ip6fl seq show() iterates through the global flowlabel hash under a seq-file RCU read-side lock and accesses fl->opt->opt nflen when an option block is present. Because exclusive flowlabels free fl->opt immediately when fl->users reaches zero in fl release(), but the struct ip6 flowlabel remains in the global hash table until garbage collection and fl free rcu() occur, a race condition exists. A concurrent reader of '/proc/net/ip6 flowlabel' can dereference the freed option state, leading to a system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31680

ECHO-F2CC-9B31-6969

OESA-2026-2232

OESA-2026-2234

OESA-2026-2235

OESA-2026-2236

Affected Products

Linux Kernel

References · 44

• https://nvd.nist.gov/vuln/detail/CVE-2026-23383 · Security Note
• https://git.kernel.org/stable/c/9ca562bb8e66978b53028fa32b1a190708e6a091 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31449 · Security Note
• https://git.kernel.org/stable/c/8027964931785cb73d520ac70a342a3dc16c249b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31418 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31680 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31450 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31680 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2235 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31680 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31680 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31680 · Security Note