CVE-2026-31695

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free

Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for

the virt_wifi net devices. However, unregistering a virt_wifi device in

netdev_run_todo() can happen together with the device referenced by

SET_NETDEV_DEV().

It can result in use-after-free during the ethtool operations performed

on a virt_wifi device that is currently being unregistered. Such a net

device can have the `dev.parent` field pointing to the freed memory,

but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.

Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:

==================================================================

BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0

Read of size 2 at addr ffff88810cfc46f8 by task pm/606

Call Trace:

<TASK>

dump_stack_lvl+0x4d/0x70

print_report+0x170/0x4f3

? __pfx__raw_spin_loc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References