CVE-2026-31680

What it actually does

This is a Linux kernel use-after-free in IPv6 flow label handling. An exclusive IPv6 flow label can release its associated option block while the enclosing flow label object remains reachable through the global flow label hash table under RCU. A concurrent reader of /proc/net/ip6_flowlabel can then dereference the freed option pointer in ip6fl_seq_show(), causing kernel memory corruption. The most direct impact is a local kernel crash and denial of service; depending on allocator state, hardening, and exploit development, use-after-free conditions in kernel context may also be explored for local privilege escalation or information disclosure.

Why it matters to the business

An attacker who already has local code execution, a shell account, or code running inside a sufficiently capable container may be able to crash an affected Linux host and interrupt workloads. In shared systems, CI/CD runners, hosting platforms, container nodes, and multi-user servers, this can translate into service downtime, failed jobs, node reboots, and potential escalation risk from a low-privileged foothold. The vulnerability is not currently listed in CISA KEV, is not marked as ransomware-used, has very low EPSS, and has no reported public exploit maturity, so urgency is lower than actively exploited internet-facing flaws but still important for systems exposed to untrusted local users or workloads.

How an attack unfolds

An attacker first obtains the ability to run local code on an affected Linux system. They then exercise IPv6 flow label functionality to create exclusive flow labels with option state. By releasing references to the flow label, they trigger early freeing of the option block while the flow label object can still be observed through the global hash until later garbage collection. In parallel, the attacker repeatedly reads /proc/net/ip6_flowlabel, causing the kernel seq-file display path ip6fl_seq_show() to inspect the stale flow label and dereference the already-freed option pointer. A reliable attack is expected to race flow label release against procfs reads and may use heap grooming to influence the freed memory. The likely observable outcome is a kernel oops, panic, or host crash; a more advanced exploit could attempt to convert the use-after-free into kernel-level code execution or privilege escalation, although no public exploit is indicated by the provided intelligence.

How to fix it

Apply the Linux kernel update from the relevant distribution or upstream stable branch that includes the fix to defer freeing the IPv6 flow label option block until RCU teardown in fl_free_rcu(). No exact fixed package versions were provided, so use vendor advisories for the deployed distribution and kernel stream. Prioritize multi-user systems, container hosts, build runners, bastion hosts, and any servers where untrusted users or workloads can execute local code. If immediate patching is not possible, reduce exposure by limiting local shell access, isolating untrusted workloads, disabling or restricting unprivileged containers where practical, monitoring for kernel crashes, and disabling IPv6 only where it is operationally safe and verified not to affect required services.

How to confirm the fix worked

Confirm the running kernel is no longer in an affected build line by checking the installed and booted kernel version with distribution package metadata and vendor security advisories. Ensure systems have been rebooted into the patched kernel after package installation; merely installing a kernel package is insufficient. Where source or backport verification is required, confirm the kernel contains the flow label lifetime fix that keeps fl->opt alive until fl_free_rcu() rather than freeing it early in fl_release(). Validate exposure by checking whether IPv6 is enabled and whether local users, containers, or services can read /proc/net/ip6_flowlabel. Avoid proof-of-concept race testing on production systems because successful validation may crash the host.

Typical attack path

1. Gain local code execution on an affected Linux host, such as through a shell, compromised service account, or local workload.
2. Create IPv6 flow labels that include option state and are marked exclusive.
3. Drop references to the flow label so fl_release() frees the option block while the parent flow label remains reachable under RCU.
4. Concurrently read /proc/net/ip6_flowlabel in a tight loop to force ip6fl_seq_show() to walk the global flow label hash.
5. Win the race so the procfs reader dereferences the freed fl->opt pointer.
6. Trigger a kernel oops, panic, or potentially attempt heap manipulation for privilege escalation.

How to detect it

To determine whether exploitation may have already occurred, review kernel logs, system journals, crash dumps, and host telemetry for kernel faults involving IPv6 flow labels and procfs reads. Useful sources include journalctl -k, dmesg archives, /var/log/kern.log, /var/log/messages, /var/crash, kdump/vmcore analysis, auditd logs, EDR process telemetry, and shell/process accounting where available. Look for kernel oops or panic traces showing ip6fl_seq_show(), ip6_flowlabel, fl_release(), seq_read_iter(), or reads of /proc/net/ip6_flowlabel shortly before a crash. Also look for suspicious local processes repeatedly opening or reading /proc/net/ip6_flowlabel, especially when paired with high-rate IPv6 flow label operations, unexplained reboots, or crashes on shared/container hosts. Absence of logs does not prove non-exploitation because a successful denial-of-service may interrupt logging before all artifacts are written.

• /proc/net/ip6_flowlabel
• ip6fl_seq_show
• fl_release
• fl_free_rcu
• ip6_flowlabel
• KASAN: use-after-free
• BUG: KASAN: use-after-free in ip6fl_seq_show
• BUG: unable to handle kernel paging request
• general protection fault
• kernel BUG at
• Oops:
• RIP: 0010:ip6fl_seq_show
• Call Trace:
• seq_read_iter
• seq_read
• panic: Fatal exception
• IPv6: flowlabel

What your security team should do

• Inventory Linux systems by kernel version and identify hosts running affected, unpatched kernels.
• Prioritize patching for systems that allow local user access, run untrusted workloads, host containers, or support shared build and execution environments.
• Reboot patched systems and verify the active kernel, not just the installed package version.
• Review recent kernel logs and crash dumps for ip6fl_seq_show(), /proc/net/ip6_flowlabel, use-after-free, general protection fault, or kernel paging fault messages.
• Add temporary monitoring for unusual or repeated reads of /proc/net/ip6_flowlabel by non-administrative processes where audit or EDR tooling supports procfs access visibility.
• Limit untrusted local execution and container privileges until patching is complete.
• Track distribution advisories because fixed versions may vary by vendor backport and kernel branch.