CVE-2026-31680
kernel: net: ipv6: flowlabel: defer exclusive option free until RCU teardown
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 25, 2026
Updated · July 3, 2026
Description
A flaw was found in the Linux kernel. A local user can exploit a race condition in the IPv6 flow label handling, specifically during the teardown of exclusive flow label options. This can lead to a use-after-free vulnerability when a concurrent reader accesses freed option state, triggering a system crash and a Denial of Service (DoS).
Statement
IPv6 flowlabel exclusive options were freed too early vs RCU readers; upstream defers free to teardown. Red Hat notes this is a local netns/flowlabel UAF race.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-825 · Expired Pointer Dereference