CVE-2026-31406

A flaw was found in the Linux kernel, specifically within its xfrm (IP eXtensible FRamework) component. This vulnerability arises from a race condition during network cleanup, where a scheduled task (nat_keepalive_work) can be re-activated and attempt to operate on memory that has already been freed. This 'use-after-free' condition could allow a local attacker to cause the system to crash, leading to a denial of service, or potentially execute unauthorized code.

After cancel_delayed_work_sync() in xfrm_nat_keepalive_net_fini(), state deletion could reschedule nat_keepalive_work on a net being torn down. Replacing with disable_delayed_work_sync() prevents new schedules. Trigger is network namespace teardown with xfrm NAT keepalive in use.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.