CVE-2026-31504

A flaw was found in the Linux kernel. A race condition in the packet_release() function, specifically during a network device up (NETDEV_UP) event, can lead to a Use-After-Free (UAF) vulnerability. This occurs when a socket is re-registered into a fanout group's array, leaving a dangling pointer. A local attacker could potentially exploit this to cause memory corruption, which may result in a denial of service or privilege escalation.

The fix clears po->num under bind_lock so NETDEV_UP cannot re-link a fanout socket mid-release, closing the dangling f->arr[] entry found during audit of related fanout bugs. Red Hat recommends patched kernels for any workload using AF_PACKET fanout. Unloading af_packet is a blunt mitigation where policy permits.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the af_packet module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.