CVE-2026-31504

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the s...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < ee642b1962caa9aa231c01abbd58bc453ae6b66e, >= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < 42cfd7898eeed290c9fb73f732af1f7d6b0a703e, >= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < 1b4c03f8892d955385c202009af7485364731bb9, >= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < 654386baef228c2992dbf604c819e4c7c35fc71b, >= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < 75fe6db23705a1d55160081f7b37db9665b1880b, >= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6, >= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < ceccbfc6de720ad633519a226715989cfb065af1, >= ce06b03e60fc19c680d1bf873e779bf11c2fc518 < 42156f93d123436f2a27c468f18c966b7e5db796, >= 3.1, >= V3.1.6, >= V3.1.5, >= 3.1.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.168, >= 6.2 < 6.6.131, >= 6.7 < 6.12.80, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 3.1, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416