CVE-2026-31469

What it actually does

This vulnerability is a use-after-free in the Linux kernel virtio_net driver. When virtio_net is running with transmit NAPI disabled and the network device has the IFF_XMIT_DST_RELEASE flag cleared, socket buffers can remain queued in the virtio transmit ring while still referencing routing destination state. If the associated network namespace is destroyed before those queued buffers are freed, the referenced dst_ops structure may already have been released. A later transmit path cleanup calls dst_release() through the stale destination reference, causing a kernel use-after-free and paging fault. The most direct impact is a local kernel crash or denial of service; because this is a kernel memory-safety issue reachable by a locally privileged user, privilege escalation or broader confidentiality/integrity impact may be possible depending on exploitability, kernel configuration, and memory layout protections.

Why it matters to the business

Systems using Linux virtual network interfaces backed by virtio_net may be exposed to local disruption if users or workloads can manipulate network namespaces, traffic control filters, routes, or related network device configuration. Successful exploitation can crash affected hosts or virtual machines, interrupting applications and services running on them. The vulnerability is not listed in CISA KEV, is not associated with ransomware use, has very low EPSS, and has no reported public exploit maturity in the provided data, so broad internet-scale exploitation is unlikely; however, the operational impact can be high in multi-tenant, containerized, CI/CD, lab, or virtualization-heavy environments where local users or containers have elevated network administration capabilities.

How an attack unfolds

An attacker first needs local access with sufficient privileges to alter network namespace and network device configuration, such as capabilities that permit creating network namespaces, moving a virtio-backed interface into a namespace, configuring traffic control route filters, and modifying routes. The attacker configures a qdisc and route filter in a way that clears IFF_XMIT_DST_RELEASE on the virtio_net device. They then generate traffic so socket buffers are queued in the virtio transmit ring while holding destination references. Next, the attacker destroys the network namespace before those queued buffers have been fully transmitted and freed. When later network transmission triggers virtio_net cleanup through free_old_xmit(), the driver releases an skb destination whose dst_ops has already been freed, leading to a kernel use-after-free and typically a kernel oops, panic, or crash. No named threat actor exploitation is reported in the provided intelligence.

How to fix it

Apply a Linux kernel update from the affected distribution or kernel vendor that includes the virtio_net fix adding skb_dst_drop(skb) in start_xmit before the skb is queued. No exact fixed package versions were provided in the input, so remediation should be tracked through the relevant distribution advisories for the deployed kernel branch. Prioritize hosts and virtual machines that use virtio_net and allow local users, containers, or automation to create network namespaces or manage traffic control. If immediate patching is not possible, reduce exposure by limiting CAP_NET_ADMIN, restricting unprivileged user namespaces where feasible, preventing untrusted workloads from moving physical or virtual interfaces into network namespaces, limiting access to tc and ip route operations, and monitoring or disabling risky traffic-control route filter workflows on virtio_net interfaces. Reboot into the patched kernel after installation; merely installing kernel packages is not sufficient if the running kernel remains vulnerable.

How to confirm the fix worked

Confirm the running kernel, not just the installed kernel package, has been updated to a vendor build containing the virtio_net fix. Validate with commands such as uname -r, package-manager kernel inventory, and the distribution security advisory for this CVE. Confirm virtio_net is present or in use with lsmod, modinfo virtio_net, ethtool -i <interface>, or by inspecting /sys/class/net/*/device/driver. Verify that high-risk local capabilities are constrained by checking container runtime profiles, Linux capabilities, sudo rules, and whether untrusted users can run ip netns, tc qdisc, tc filter, or ip route commands. For regression testing in non-production only, reproduce the vulnerable traffic-control and network-namespace sequence against a patched test host and verify that it does not produce a kernel oops, panic, or call trace involving dst_release(), skb_release_head_state(), __free_old_xmit(), or virtio_net start_xmit().

Typical attack path

1. Obtain local access to a Linux system using a virtio_net network device.
2. Gain or already possess network administration capability, such as CAP_NET_ADMIN, root privileges, or equivalent container/namespace privileges.
3. Configure traffic control qdisc and route filter rules that clear IFF_XMIT_DST_RELEASE on the target virtio_net network device.
4. Move or configure the virtio-backed network interface inside a network namespace.
5. Generate network traffic so socket buffers remain pending in the virtio transmit ring.
6. Delete the network namespace while those socket buffers still reference destination routing state.
7. Trigger subsequent transmission on the virtio_net device, causing free_old_xmit() to clean up stale queued buffers.
8. Cause dst_release() to operate on freed dst_ops memory, resulting in a kernel fault and likely denial of service.

How to detect it

Look for evidence of kernel crashes, oops events, panics, or paging faults involving virtio_net transmit cleanup. Relevant sources include journalctl -k, /var/log/kern.log, /var/log/messages, dmesg output, crash dump metadata, kdump/vmcore analysis, hypervisor reset events, and endpoint telemetry that records local execution of network administration commands. Search for command activity involving tc qdisc, tc filter route rules, ip route realm configuration, ip netns creation/deletion, and movement of virtio-backed interfaces into namespaces immediately before a crash. In containerized environments, review auditd, eBPF, EDR, shell history, sudo logs, and container runtime logs for processes invoking ip, tc, ifconfig, ping, or scripts that repeatedly create and delete network namespaces. Exploitation is most likely to leave denial-of-service artifacts rather than durable files. Kernel traces containing dst_release(), skb_release_head_state(), napi_consume_skb(), __free_old_xmit(), free_old_xmit(), start_xmit(), or drivers/net/virtio_net.c are strong indicators that the crash path matches this vulnerability, though they should be correlated with local namespace and traffic-control activity to distinguish testing from accidental triggering.

• Unable to handle kernel paging request
• virtio_net: Fix UAF on dst_ops
• dst_release+0xe0/0x110
• skb_release_head_state
• sk_skb_reason_drop
• dev_kfree_skb_any_reason
• napi_consume_skb
• __free_old_xmit
• free_old_xmit
• start_xmit
• drivers/net/virtio_net.c
• lib/percpu_counter.c:98
• net/core/dst.c:177
• net/core/skbuff.c:1177
• net/core/skbuff.c:1255
• net/core/dev.c:3469
• net/core/skbuff.c:1527
• tc qdisc add dev
• tc filter add dev
• protocol ip prio 100 route
• ip route add
• realm 100
• ip netns add
• ip netns del
• ip link set
• IFF_XMIT_DST_RELEASE
• napi_tx=N

What your security team should do

• Inventory Linux hosts and virtual machines using virtio_net, especially virtualization, cloud, container, CI/CD, and multi-tenant systems.
• Prioritize kernel updates for systems where untrusted or semi-trusted users can obtain CAP_NET_ADMIN, create network namespaces, configure tc filters, or manage routes.
• Restrict CAP_NET_ADMIN and unprivileged namespace creation for workloads that do not explicitly require them.
• Review container and orchestration policies to prevent untrusted containers from moving host or virtio-backed interfaces into network namespaces.
• Monitor kernel logs for crashes or call traces matching virtio_net transmit cleanup, dst_release(), skb_release_head_state(), and use-after-free symptoms.
• Ensure patched kernel packages are followed by host reboot or live-patch confirmation, as applicable.
• Because EPSS is low, KEV status is false, and no exploit maturity is reported, treat this as targeted/local-risk remediation rather than an emergency internet-facing patch, unless affected systems are multi-tenant or grant network administration capabilities broadly.