SECUFOCUSNOW
Home›CVE index›CVE-2026-31469
Review reviewHigh

CVE-2026-31469

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared (e.g., during the configuration of tc route filter rules). When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring...

CVSS
7.8
EPSS
0.14%
3.39% percentile
CISA KEV
Not listed
Published
2026.04.22
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.14%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared (e.g., during the configuration of tc route filter rules). When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring...

Affected product and versions

Product
Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Affected versions
>= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < be0e63f3b97bbaf453c542e8a15ba2a536e2ac01, >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < c1ec36cb3768574b916f20d2d7415fd14fa1bf12, >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < 8a4790850e710fd6771e4d2112168ed1dd6c0e54, >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < fedd2e1630cac920844997227ccbe7b26a76375a, >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < f04733c4dc40c43899c3d1c97afbae5831a3770f, >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < 9a18629f2525781f0f3dda7be72b204e4cf77d08, >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < 63d45077b97bb0e0fe0c75931acbbca7a47af141, >= f2fc6a54585a1be6669613a31fbaba2ecbadcd36 < ba8bda9a0896746053aa97ac6c3e08168729172c, >= 2.6.26, >= V3.1.6, >= V3.1.5, >= 2.6.26 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.168, >= 6.2 < 6.6.131, >= 6.7 < 6.12.80, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 7.0
Fixed versions
5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416