CVE-2026-31504

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: fix fanout UAF in packet_release() via NETDEV_UP race

`packet_release()` has a race window where `NETDEV_UP` can re-register a

socket into a fanout group's `arr[]` array. The re-registration is not

cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout

array.

`packet_release()` does NOT zero `po->num` in its `bind_lock` section.

After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`

still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`

that already found the socket in `sklist` can re-register the hook.

For fanout sockets, this re-registration calls `__fanout_link(sk, po)`

which adds the socket back into `f->arr[]` and increments `f->num_members`,

but does NOT increment `f->sk_ref`.

The fix sets `po->num` to zero in `packet_release` while `bind_lock` is

held to prevent NETDEV_UP from linking, preventing the race window.

This bug was found following an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References