CVE-2026-31469

A flaw was found in the Linux kernel's virtio_net driver. A local user can trigger a Use-After-Free (UAF) vulnerability by configuring the driver with specific network settings and then destroying the network namespace while data packets are still being transmitted. This premature freeing of network resources, specifically the dst_ops structure, can lead to a kernel paging request, resulting in a system crash and a Denial of Service (DoS).

Red Hat recognizes the virtio_net interaction between cleared IFF_XMIT_DST_RELEASE, napi_tx=N, and netns teardown that left stale dst references. Upstream drops the dst before queueing SKBs in start_xmit. Severity should reflect networking-adjacent UAF with local admin-style netns control; review PR:N if your product exposes unprivileged netns freely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the virtio_net module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.