CVE-2026-31406

Vulnerability

Description

CVE-2026-31406 is a use-after-free vulnerability in the Linux kernel's xfrm (IPsec) subsystem. The root cause is a race condition during network namespace cleanup. In xfrm_nat_keepalive_net_fini(), cancel_delayed_work_sync() is called to stop the nat_keepalive_work delayed work. However, subsequent calls to xfrm_state_fini() -> xfrm_state_flush() -> __xfrm_state_delete() can trigger xfrm_nat_keepalive_state_updated(), which re-schedules the same work via schedule_delayed_work(). This re-scheduling occurs after the work has been cancelled but before the network namespace memory is freed, leading to a use-after-free when the work eventually executes on a freed net structure [1].

Exploitation

Exploitation requires an attacker to trigger the race condition during network namespace teardown. The attack surface is local, as the vulnerability resides in kernel code that is exercised when a network namespace is destroyed. No special privileges are needed beyond the ability to create and destroy network namespaces, which is available to unprivileged users in many configurations. The race window is narrow but can be reliably hit with careful timing, as demonstrated by the kernel developers in the fix commit [1].

Impact

If successfully exploited, this use-after-free can lead to a kernel crash (denial of service) or potentially allow an attacker to escalate privileges by corrupting kernel memory. The CVSS v3 score of 7.8 (High) reflects the high impact on confidentiality, integrity, and availability, given that the attack vector is local and requires low privileges [1].

Mitigation

The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() in xfrm_nat_keepalive_net_fini(). The disable_delayed_work_sync() function prevents the work from being re-scheduled after cancellation, closing the race window. The patch has been applied to the Linux kernel stable branches as of April 2026 [1][2][3][4]. Users should update their kernels to include the fix.