CVE-2026-31469

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false

A UAF issue occurs when the virtio_net driver is configured with napi_tx=N

and the device's IFF_XMIT_DST_RELEASE flag is cleared

(e.g., during the configuration of tc route filter rules).

When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack

expects the driver to hold the reference to skb->dst until the packet

is fully transmitted and freed. In virtio_net with napi_tx=N,

skbs may remain in the virtio transmit ring for an extended period.

If the network namespace is destroyed while these skbs are still pending,

the corresponding dst_ops structure has freed. When a subsequent packet

is transmitted, free_old_xmit() is triggered to clean up old skbs.

It then calls dst_release() on the skb associated with the stale dst_entry.

Since the dst_ops (referenced by the dst_entry) has already been freed,

a UAF kernel p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References