CVE-2026-31508

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: Avoid releasing netdev before teardown completes

The patch cited in the Fixes tag below changed the teardown code for

OVS ports to no longer unconditionally take the RTNL. After this change,

the netdev_destroy() callback can proceed immediately to the call_rcu()

invocation if the IFF_OVS_DATAPATH flag is already cleared on the

netdev.

The ovs_netdev_detach_dev() function clears the flag before completing

the unregistration, and if it gets preempted after clearing the flag (as

can happen on an -rt kernel), netdev_destroy() can complete and the

device can be freed before the unregistration completes. This leads to a

splat like:

[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI

[ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT

[ 998.393886] Hardware name: Dell

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References