CVE-2026-31695: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31695 Overview

CVE-2026-31695 is a use-after-free vulnerability [CWE-416] in the Linux kernel's virt_wifi driver. The flaw originates from the use of SET_NETDEV_DEV(dev, &priv->lowerdev->dev) for virt_wifi network devices. When a virt_wifi device is unregistered through netdev_run_todo(), the parent device referenced by SET_NETDEV_DEV() can be freed concurrently. Subsequent ethtool operations dereference the freed memory through ethnl_ops_begin(), which calls pm_runtime_get_sync(dev->dev.parent), triggering KASAN slab-use-after-free reports.

Critical Impact
Local attackers with low privileges can trigger memory corruption in the Linux kernel through ethtool operations on a virt_wifi device being unregistered, leading to potential privilege escalation or denial of service.

Affected Products

Linux Kernel (multiple stable branches with the virt_wifi driver)
Linux Kernel 7.0-rc1 through 7.0-rc7
Distributions shipping vulnerable kernel versions with virt_wifi enabled

Discovery Timeline

2026-05-01 - CVE-2026-31695 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31695

Vulnerability Analysis

The virt_wifi driver creates a virtual Wi-Fi interface layered on top of an existing Ethernet device. During initialization, it calls SET_NETDEV_DEV(dev, &priv->lowerdev->dev) to set the parent device pointer of the virtual interface to the lower device. This creates a lifetime dependency that the driver does not enforce.

When the virt_wifi device is unregistered via netdev_run_todo(), the lower device referenced by dev.parent may be freed concurrently. Any concurrent ethtool netlink operation on the virt_wifi device passes through ethnl_ops_begin(), which invokes pm_runtime_get_sync(dev->dev.parent) on the dangling pointer. KASAN reports this as a slab-use-after-free read of size 2 inside __pm_runtime_resume().

The vulnerability is classified as [CWE-416] Use After Free. Exploitation requires local access and the ability to trigger ethtool operations during device teardown.

Root Cause

The root cause is improper object lifetime management between the virt_wifi virtual device and its parent (lower) device. Setting dev.parent through SET_NETDEV_DEV() does not take a reference that survives concurrent unregistration. The ethtool subsystem assumes dev.parent remains valid for the lifetime of the netdev, but virt_wifi violates this assumption.

Attack Vector

A local user with permission to trigger ethtool netlink operations and unregister network devices can race the two operations to access freed slab memory. The crash trace shows the path: netlink_sendmsg → genl_rcv_msg → ethnl_set_features → ethnl_ops_begin → __pm_runtime_resume, where the freed dev->dev.parent pointer is dereferenced. Successful exploitation can corrupt kernel memory, leading to denial of service or privilege escalation depending on heap state.

The upstream fix removes SET_NETDEV_DEV from virt_wifi so the virtual device no longer references a parent device that can be freed independently. A complementary fix in the ethtool subsystem hardens ethnl_ops_begin() against similar races.

Detection Methods for CVE-2026-31695

Indicators of Compromise

KASAN reports referencing slab-use-after-free in __pm_runtime_resume on systems with virt_wifi loaded
Kernel oopses or panics in the call chain ethnl_ops_begin → pm_runtime_get_sync during virt_wifi device teardown
Unexpected kernel log entries from ethnl_set_features correlated with virt_wifi unregistration events

Detection Strategies

Audit running kernels against the vendor advisory git commits to confirm whether the virt_wifi patch is applied
Monitor kernel ring buffer (dmesg) for KASAN, BUG, or general protection fault entries citing virt_wifi, __pm_runtime_resume, or ethnl_ops_begin
Track netlink ethtool activity (ETHTOOL_MSG_FEATURES_SET) issued against virt_wifi interfaces by unprivileged users

Monitoring Recommendations

Centralize kernel logs and alert on use-after-free signatures involving virt_wifi or ethtool netlink paths
Inventory hosts where the virt_wifi module is loaded (lsmod | grep virt_wifi) and prioritize them for patching
Correlate netdev unregistration events with concurrent ethtool syscalls to identify race attempts

How to Mitigate CVE-2026-31695

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits to all affected systems
If patching is not immediately feasible, unload the virt_wifi module on systems that do not require it
Restrict local access on multi-tenant systems where untrusted users can issue ethtool operations

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches that remove SET_NETDEV_DEV from the virt_wifi driver. The relevant commits are available at the kernel.org stable tree, including commit 789b06f, commit 5adc015, commit 5bbadf6, commit c5fa988, commit d1e3aa8, commit dcb5915, and commit e90f3e7. Distribution-specific kernel updates should be installed as they become available.

Workarounds

Blacklist the virt_wifi kernel module on systems that do not require virtual Wi-Fi functionality
Limit CAP_NET_ADMIN and netlink access to trusted administrative accounts to reduce the attacker pool
Disable user namespaces for unprivileged users where policy allows, eliminating an avenue to reach the vulnerable code path

bash

# Blacklist the virt_wifi module to prevent loading
echo "blacklist virt_wifi" | sudo tee /etc/modprobe.d/blacklist-virt_wifi.conf
sudo rmmod virt_wifi 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep virt_wifi

# Apply the latest distribution kernel update
sudo apt update && sudo apt upgrade linux-image-$(uname -r)