PT-2026-35140 · Linux · Linux

Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-31680

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: flowlabel: defer exclusive option free until RCU teardown

ip6fl seq show() walks the global flowlabel hash under the seq-file RCU read-side lock and prints fl->opt->opt nflen when an option block is present.

Exclusive flowlabels currently free fl->opt as soon as fl->users drops to zero in fl release(). However, the surrounding struct ip6 flowlabel remains visible in the global hash table until later garbage collection removes it and fl free rcu() finally tears it down.

A concurrent /proc/net/ip6 flowlabel reader can therefore race that early kfree() and dereference freed option state, triggering a crash in ip6fl seq show().

Fix this by keeping fl->opt alive until fl free rcu(). That matches the lifetime already required for the enclosing flowlabel while readers can still reach it under RCU.

Related Identifiers

CVE-2026-31680

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-31680 · Security Note
• https://git.kernel.org/stable/c/572ce62778519a7d4d1c15f55dd2e45a474133c4 · Note
• https://git.kernel.org/stable/c/3c54b66c83fb8fcbde8e6a7bf90b65856e39f827 · Note
• https://git.kernel.org/stable/c/9ca562bb8e66978b53028fa32b1a190708e6a091 · Note
• https://git.kernel.org/stable/c/4b6798024f7b2d535f3db1002c760143cdbd1bd3 · Note
• https://git.kernel.org/stable/c/5a6b15f861b7c1304949e3350d23490a5fe429fd · Note
• https://git.kernel.org/stable/c/6c7fbdb8ffde6413640de7cfbd7c976c353e89f8 · Note
• https://git.kernel.org/stable/c/414726b69921fe6355ae453f5b35e68dd078342a · Note
• https://git.kernel.org/stable/c/8027964931785cb73d520ac70a342a3dc16c249b · Note