CVE-2026-31579

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit

wg_netns_pre_exit() manually acquires rtnl_lock() inside the

pernet .pre_exit callback. This causes a hung task when another

thread holds rtnl_mutex - the cleanup_net workqueue (or the

setup_net failure rollback path) blocks indefinitely in

wg_netns_pre_exit() waiting to acquire the lock.

Convert to .exit_rtnl, introduced in commit 7a60d91c690b ("net:

Add ->exit_rtnl() hook to struct pernet_operations."), where the

framework already holds RTNL and batches all callbacks under a

single rtnl_lock()/rtnl_unlock() pair, eliminating the contention

window.

The rcu_assign_pointer(wg->creating_net, NULL) is safe to move

from .pre_exit to .exit_rtnl (which runs after synchronize_rcu())

because all RCU readers of creating_net either use maybe_get_net()

- which returns NULL for a dying namespace with zero refcount - or

access net->user_ns which

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References