CVE-2026-31680

Vulnerability

CVE-2026-31680 is a use-after-free vulnerability in the Linux kernel's IPv6 flowlabel subsystem. The root cause is that exclusive flowlabels free their associated option block (fl->opt) as soon as the reference count (fl->users) drops to zero in fl_release(). However, the enclosing struct ip6_flowlabel remains visible in the global hash table until later garbage collection and is only torn down later by fl_free_rcu() under RCU. This creates a window where a concurrent reader of /proc/net/ip6_flowlabel can access freed option state, leading to a crash [1].

Exploitation

The attack surface is local; an unprivileged user can trigger the race by opening /proc/net/ip6_flowlabel while the kernel is processing flowlabel release operations. No special privileges are required beyond the ability to read the proc file and to create IPv6 flowlabels (which may be available to unprivileged users depending on system configuration). The race occurs because ip6fl_seq_show() walks the global flowlabel hash under the seq-file RCU read-side lock and dereferences fl->opt->opt_nflen without ensuring the option block is still alive [1].

Impact

A successful exploit results in a kernel crash (denial of service). The vulnerability does not appear to allow privilege escalation or arbitrary code execution based on the available information, but a crash can disrupt system availability. The CVSS v3 score of 7.8 (High) reflects the potential for significant impact on system operation [1].

Mitigation

The fix defers freeing of fl->opt until fl_free_rcu(), ensuring the option block remains valid for any RCU-protected reader. The patch has been applied to the stable kernel tree and is available in commits [1], [2], [3], and [4] for various stable branches. Users should update their kernels to include the fix. No workaround is documented; the only mitigation is to apply the kernel patch.