CVE-2026-31579: Linux Kernel Race Condition Vulnerability

CVE-2026-31579 Overview

CVE-2026-31579 is a Linux kernel vulnerability in the WireGuard VPN driver that causes hung tasks through improper locking in network namespace cleanup. The flaw resides in wg_netns_pre_exit(), which manually acquires rtnl_lock() inside the pernet .pre_exit callback. When another thread already holds rtnl_mutex, the cleanup_net workqueue or the setup_net failure rollback path blocks indefinitely while waiting for the lock. A local attacker with low privileges can trigger this condition to cause a denial of service against the affected host.

Critical Impact
Local low-privileged users can trigger indefinite kernel task hangs in network namespace cleanup, leading to denial of service on systems running WireGuard.

Affected Products

Linux Kernel (mainline stable branches prior to fixed commits)
Distributions shipping WireGuard in-tree with affected pernet operations
Systems using network namespaces with WireGuard interfaces

Discovery Timeline

2026-04-24 - CVE-2026-31579 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31579

Vulnerability Analysis

The vulnerability is a null pointer dereference and locking contention issue [CWE-476] in the WireGuard kernel module. The wg_netns_pre_exit() function manually called rtnl_lock() from inside the pernet .pre_exit callback. The pernet operations framework can invoke this callback from contexts where another thread already holds rtnl_mutex. The result is an unbounded wait that manifests as a hung task warning and effectively freezes network namespace teardown.

The fix migrates the callback to .exit_rtnl, introduced in commit 7a60d91c690b ("net: Add ->exit_rtnl() hook to struct pernet_operations."). The framework already holds RTNL across .exit_rtnl invocations and batches callbacks under a single rtnl_lock()/rtnl_unlock() pair, removing the contention window.

Root Cause

The root cause is incorrect locking discipline in the pernet cleanup path. Moving rcu_assign_pointer(wg->creating_net, NULL) from .pre_exit to .exit_rtnl is safe because .exit_rtnl runs after synchronize_rcu(). All RCU readers of creating_net either use maybe_get_net(), which returns NULL for a dying namespace with zero refcount, or access net->user_ns, which remains valid across the entire ops_undo_list sequence.

Attack Vector

Exploitation requires local access with the ability to create and destroy network namespaces containing WireGuard interfaces. An unprivileged user with CAP_NET_ADMIN in a user namespace can trigger repeated namespace cleanup operations that race with other RTNL holders. The resulting hung tasks degrade host availability without granting code execution or data access.

The vulnerability mechanism is described in the upstream kernel commits. See the references for the full patch series and technical details.

Detection Methods for CVE-2026-31579

Indicators of Compromise

Kernel hung_task warnings referencing wg_netns_pre_exit or cleanup_net in dmesg and /var/log/messages.
Stalled cleanup_net kernel worker threads visible in ps auxf output with state D (uninterruptible sleep).
Increasing number of network namespaces failing to release, observable via ip netns list and /proc/net/.

Detection Strategies

Monitor kernel logs for INFO: task ... blocked for more than messages with stack traces touching rtnl_lock and WireGuard symbols.
Track the running kernel version against the fixed commits 1c52ef0, 60a25ef, 9a9e691, and a1d0f6c referenced in the vendor advisories.
Audit hosts for WireGuard module load state with lsmod | grep wireguard and correlate with namespace churn metrics.

Monitoring Recommendations

Enable kernel.hung_task_timeout_secs alerting and forward kernel messages to a centralized log platform.
Baseline normal namespace creation and destruction rates so anomalous spikes that could trigger the race are flagged.
Watch for processes holding rtnl_mutex for extended periods alongside WireGuard activity.

How to Mitigate CVE-2026-31579

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 1c52ef0, 60a25ef, 9a9e691, and a1d0f6c from the Linux stable tree.
Update to a distribution kernel that includes the WireGuard .exit_rtnl conversion.
Restrict the ability of unprivileged users to create user namespaces on hosts that do not require this capability.

Patch Information

The fix converts wg_netns_pre_exit to use the .exit_rtnl callback hook in struct pernet_operations and adds __net_exit and __read_mostly annotations. Reference the four kernel.org commits in the vendor advisories: Kernel Git Commit 1c52ef0, Kernel Git Commit 60a25ef, Kernel Git Commit 9a9e691, and Kernel Git Commit a1d0f6c.

Workarounds

Unload the WireGuard kernel module with modprobe -r wireguard on hosts that do not require it until patching is complete.
Disable unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 via sysctl to limit who can trigger the cleanup path.
Limit container runtimes and orchestrators from rapidly cycling network namespaces with WireGuard devices on unpatched hosts.

bash

# Configuration example
# Restrict unprivileged namespace creation as a temporary mitigation
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2026-31579.conf

# Verify WireGuard module status and unload if not required
lsmod | grep wireguard
sudo modprobe -r wireguard