Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31469— virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于网络命名空间销毁时未正确处理skb引用，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1562.001

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux f2fc6a54585a1be6669613a31fbaba2ecbadcd36< be0e63f3b97bbaf453c542e8a15ba2a536e2ac01 affected
f2fc6a54585a1be6669613a31fbaba2ecbadcd36< c1ec36cb3768574b916f20d2d7415fd14fa1bf12 affected
f2fc6a54585a1be6669613a31fbaba2ecbadcd36< 8a4790850e710fd6771e4d2112168ed1dd6c0e54 affected
f2fc6a54585a1be6669613a31fbaba2ecbadcd36< fedd2e1630cac920844997227ccbe7b26a76375a affected
f2fc6a54585a1be6669613a31fbaba2ecbadcd36< f04733c4dc40c43899c3d1c97afbae5831a3770f affected
f2fc6a54585a1be6669613a31fbaba2ecbadcd36< 9a18629f2525781f0f3dda7be72b204e4cf77d08 affected
f2fc6a54585a1be6669613a31fbaba2ecbadcd36< 63d45077b97bb0e0fe0c75931acbbca7a47af141 affected
f2fc6a54585a1be6669613a31fbaba2ecbadcd36< ba8bda9a0896746053aa97ac6c3e08168729172c affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31469

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared (e.g., during the configuration of tc route filter rules). When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring for an extended period. If the network namespace is destroyed while these skbs are still pending, the corresponding dst_ops structure has freed. When a subsequent packet is transmitted, free_old_xmit() is triggered to clean up old skbs. It then calls dst_release() on the skb associated with the stale dst_entry. Since the dst_ops (referenced by the dst_entry) has already been freed, a UAF kernel paging request occurs. fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release the dst reference before the skb is queued in virtio_net. Call Trace: Unable to handle kernel paging request at virtual address ffff80007e150000 CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT ... percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P) dst_release+0xe0/0x110 net/core/dst.c:177 skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177 sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255 dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469 napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527 __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net] free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net] start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net] ... Reproduction Steps: NETDEV="enp3s0" config_qdisc_route_filter() { tc qdisc del dev $NETDEV root tc qdisc add dev $NETDEV root handle 1: prio tc filter add dev $NETDEV parent 1:0 \ protocol ip prio 100 route to 100 flowid 1:1 ip route add 192.168.1.100/32 dev $NETDEV realm 100 } test_ns() { ip netns add testns ip link set $NETDEV netns testns ip netns exec testns ifconfig $NETDEV 10.0.32.46/24 ip netns exec testns ping -c 1 10.0.32.1 ip netns del testns } config_qdisc_route_filter test_ns sleep 2 test_ns
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于网络命名空间销毁时未正确处理skb引用，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux f2fc6a54585a1be6669613a31fbaba2ecbadcd36 ~ be0e63f3b97bbaf453c542e8a15ba2a536e2ac01 -
Linux Linux 2.6.26 -

II. Public POCs for CVE-2026-31469

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31469

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-22 · 100 CVEs total

CVE-2026-31501 9.8 CRITICAL net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
CVE-2026-31444 9.8 CRITICAL ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
CVE-2026-31436 9.8 CRITICAL dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
CVE-2026-31463 9.8 CRITICAL iomap: fix invalid folio access when i_blkbits differs from I/O granularity
CVE-2026-31478 9.8 CRITICAL ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
CVE-2026-31448 9.4 CRITICAL ext4: avoid infinite loops caused by residual data
CVE-2026-31432 8.8 HIGH ksmbd: fix OOB write in QUERY_INFO for compound requests
CVE-2026-31433 8.8 HIGH ksmbd: fix potencial OOB in get_file_all_info() for compound requests
CVE-2026-31450 8.8 HIGH ext4: publish jinode after initialization
CVE-2026-31435 8.8 HIGH netfs: Fix read abandonment during retry
CVE-2026-31476 8.2 HIGH ksmbd: do not expire session on binding failure
CVE-2026-31464 8.1 HIGH scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
CVE-2026-31513 8.1 HIGH Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
CVE-2026-31471 7.8 HIGH xfrm: iptfs: only publish mode_data after clone setup
CVE-2026-31453 7.8 HIGH xfs: avoid dereferencing log items after push callbacks
CVE-2026-31473 7.8 HIGH media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
CVE-2026-31449 7.8 HIGH ext4: validate p_idx bounds in ext4_ext_correct_indexes
CVE-2026-31454 7.8 HIGH xfs: save ailp before dropping the AIL lock in push callbacks
CVE-2026-31502 7.8 HIGH team: fix header_ops type confusion with non-Ethernet ports
CVE-2026-31468 7.8 HIGH vfio/pci: Fix double free in dma-buf feature

Showing top 20 of 100 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31469

No comments yet

Leave a comment