CVE-2026-31516: Linux Kernel Race Condition Vulnerability

CVE-2026-31516 Overview

CVE-2026-31516 is a race condition in the Linux kernel's XFRM (IP framework for transforming packets) subsystem. The flaw exists in the handling of the per-net work item policy_hthresh.work, which can be queued via an XFRM_MSG_NEWSPDINFO request. When the network namespace is torn down before the queued work executes, xfrm_hash_rebuild() may dereference a freed struct net via container_of(). The kernel function xfrm_policy_fini() flushes policy_hash_work but fails to synchronize policy_hthresh.work, leaving a use-after-free window. The defect is classified under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
A local attacker with low privileges can trigger memory corruption in kernel space, leading to potential privilege escalation, kernel crash, or arbitrary code execution at ring 0.

Affected Products

Linux Kernel (mainline) — versions including 7.0-rc1 through 7.0-rc7
Linux Kernel 3.18 (long-term stable branch)
Linux Kernel stable branches prior to fixes in commits 29fe3a6, 4e2e778, 56ea225, and 8854e93

Discovery Timeline

2026-04-22 - CVE-2026-31516 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31516

Vulnerability Analysis

The XFRM subsystem manages IPsec security policy and state databases on a per-network-namespace basis. Each struct net contains a deferred work item, policy_hthresh.work, used to rebuild policy hash tables when threshold parameters change. User space triggers this work by sending an XFRM_MSG_NEWSPDINFO netlink message.

When the work executes, the callback xfrm_hash_rebuild() uses container_of() to recover the parent struct net pointer. If the owning namespace is destroyed between the queue and the execution of the work, the backing struct net is freed before the callback runs. The callback then dereferences stale memory, producing a use-after-free condition in kernel context.

The teardown function xfrm_policy_fini() already synchronizes policy_hash_work, but it omits the equivalent flush_work() call for policy_hthresh.work. The fix adds the missing synchronization so queued work cannot outlive namespace teardown.

Root Cause

The root cause is incomplete cleanup ordering in xfrm_policy_fini(). The function flushes one per-net work item but not the second, violating the invariant that all work referencing a struct net must complete before the structure is freed.

Attack Vector

Exploitation requires local access and the CAP_NET_ADMIN capability inside a user or network namespace. An attacker with the ability to create and destroy network namespaces can race an XFRM_MSG_NEWSPDINFO request against namespace teardown. On unprivileged user namespaces where CAP_NET_ADMIN is granted within the namespace, this expands the local attack surface to ordinary users on misconfigured systems. The exploitation mechanism is described in detail across the upstream commits referenced in the Kernel Git Commit 8854e93 patch series.

// No verified exploit code is available for CVE-2026-31516.
// The vulnerability is described in prose; see vendor commits for the patch diff.

Detection Methods for CVE-2026-31516

Indicators of Compromise

Kernel oops or panic messages referencing xfrm_hash_rebuild, policy_hthresh, or container_of in stack traces
KASAN (Kernel Address Sanitizer) reports of use-after-free in the net/xfrm/xfrm_policy.c region
Unexpected workqueue callback execution after cleanup_net() log entries for the same namespace

Detection Strategies

Enable KASAN on test and staging kernels to catch the use-after-free at runtime before production deployment
Monitor dmesg and /var/log/kern.log for crash signatures involving XFRM policy functions
Audit processes invoking netlink XFRM_MSG_NEWSPDINFO operations correlated with rapid namespace creation and deletion

Monitoring Recommendations

Track audit events for unshare(), clone() with CLONE_NEWNET, and setns() calls from non-root users
Alert on repeated CAP_NET_ADMIN operations originating from user namespaces
Forward kernel ring buffer events to a centralized SIEM for correlation across hosts and detection of crash patterns indicating exploitation attempts

How to Mitigate CVE-2026-31516

Immediate Actions Required

Apply the upstream kernel patches from commits 29fe3a6, 4e2e778, 56ea225, and 8854e93 or update to a vendor-supplied kernel containing the fix
Inventory hosts running affected mainline 7.0-rc and stable 3.18 kernels and prioritize them for patching
Restrict creation of unprivileged user namespaces on systems where it is not required by setting kernel.unprivileged_userns_clone=0

Patch Information

The fix synchronizes policy_hthresh.work in xfrm_policy_fini() so that queued work cannot reference a freed struct net. Patches are available in the following upstream commits: Kernel Git Commit 29fe3a6, Kernel Git Commit 4e2e778, Kernel Git Commit 56ea225, and Kernel Git Commit 8854e93.

Workarounds

Disable unprivileged user namespaces to reduce the local attack surface for non-root users
Restrict CAP_NET_ADMIN to trusted accounts and remove the capability from container workloads that do not need IPsec policy management
Apply seccomp filters to block XFRM_MSG_NEWSPDINFO netlink messages in container runtimes where IPsec configuration is not required

bash

# Disable unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee -a /etc/sysctl.d/99-harden.conf

# Verify the running kernel version
uname -r