CVE-2026-31680

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: flowlabel: defer exclusive option free until RCU teardown

`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file

RCU read-side lock and prints `fl->opt->opt_nflen` when an option block

is present.

Exclusive flowlabels currently free `fl->opt` as soon as `fl->users`

drops to zero in `fl_release()`. However, the surrounding

`struct ip6_flowlabel` remains visible in the global hash table until

later garbage collection removes it and `fl_free_rcu()` finally tears it

down.

A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that

early `kfree()` and dereference freed option state, triggering a crash

in `ip6fl_seq_show()`.

Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches

the lifetime already required for the enclosing flowlabel while readers

can still reach it under RCU.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References