CVE-2026-31695

What it actually does

This is a Linux kernel use-after-free in the virt_wifi network driver. virt_wifi devices can retain a parent device pointer through SET_NETDEV_DEV that may reference memory already freed while the virtual Wi-Fi netdevice is being unregistered. If an ethtool operation is performed concurrently against the virt_wifi interface during teardown, the ethtool netlink path can call pm_runtime_get_sync() through ethnl_ops_begin() using the stale dev.parent pointer, potentially causing kernel memory corruption. The CVSS vector indicates local, low-complexity exploitation requiring low privileges and no user interaction, with potential impact to confidentiality, integrity, and availability if the bug is made reliably exploitable.

Why it matters to the business

Systems running affected Linux kernels with virt_wifi functionality exposed may be vulnerable to local privilege escalation or kernel crashes. In practical terms, an attacker who already has a local foothold, such as a compromised low-privileged account or workload with sufficient access to network configuration interfaces, could attempt to destabilize the host or potentially gain higher privileges. Because this is a kernel-level flaw, successful exploitation can affect the whole system rather than a single application. Current EPSS is very low and no KEV listing or known ransomware use is reported, so urgency is lower than actively exploited internet-facing vulnerabilities, but kernel updates should still be prioritized for multi-user systems, developer workstations, virtualization hosts, containers with elevated network privileges, and environments that allow untrusted local code execution.

How an attack unfolds

An attacker first needs local code execution on a Linux system running an affected kernel. They then identify whether virt_wifi netdevices can be created or are present and whether they can interact with netlink/ethtool operations against those interfaces. The attacker races virt_wifi device unregistration against ethtool feature-setting operations. During the race, the virt_wifi netdevice may still contain a parent device pointer that refers to freed memory. When the ethtool generic netlink handler begins processing the operation, it may invoke runtime power-management logic on that stale parent pointer, triggering a use-after-free. The most likely observable result is a kernel oops, panic, or KASAN report; with additional exploit engineering, kernel memory corruption could potentially be shaped into privilege escalation. No public exploit maturity is reported in the provided data, and this vulnerability is not listed in CISA KEV.

How to fix it

Apply a Linux kernel update that includes the virt_wifi change removing SET_NETDEV_DEV usage for virt_wifi netdevices, and also review whether related ethtool subsystem fixes are included by the distribution or kernel vendor. No exact fixed versions were provided in the input, so use vendor advisories, distribution errata, or upstream stable kernel release notes to identify the corrected package for each platform. Where immediate patching is not possible, reduce exposure by disabling or preventing loading of the virt_wifi module where it is not required, limiting local user access, restricting creation and management of network devices to trusted administrators, and avoiding privileged or CAP_NET_ADMIN-capable containers for untrusted workloads. Reboot into the updated kernel after patching; installing the package alone is not sufficient if the running kernel remains vulnerable.

How to confirm the fix worked

Confirm the running kernel, not just the installed kernel package, has been updated to a vendor release containing the virt_wifi fix. Validate with commands such as uname -r, package manager queries, and vendor advisory mappings. Check whether virt_wifi is currently loaded with lsmod or present under /sys/module/virt_wifi. Confirm that vulnerable systems no longer expose the old behavior by reviewing the patched source or vendor changelog for the removal of SET_NETDEV_DEV in the virt_wifi driver. After remediation, verify systems have rebooted into the fixed kernel and that no recurring kernel logs show virt_wifi, ethtool netlink, ethnl_set_features, ethnl_ops_begin, pm_runtime_get_sync, or __pm_runtime_resume crashes. In high-assurance environments, run controlled regression testing for virt_wifi interface creation/removal and ethtool feature changes on a non-production host using the fixed kernel.

Typical attack path

1. Obtain local low-privileged execution on a Linux host running an affected kernel.
2. Check whether virt_wifi support is available, loaded, or usable on the system.
3. Create or target a virt_wifi network device if permitted by local privileges and namespace/capability configuration.
4. Trigger virt_wifi device teardown or unregistration while concurrently issuing ethtool generic netlink feature operations against the same device.
5. Win the race condition so the ethtool path dereferences a stale dev.parent pointer during runtime power-management handling.
6. Cause a kernel crash or attempt to leverage the resulting kernel use-after-free for privilege escalation.

How to detect it

Look for evidence of attempted or successful triggering in kernel logs, system journals, crash dumps, and endpoint telemetry. Relevant sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, kdump/vmcore artifacts, audit logs for ethtool or network-management activity, and EDR records showing local processes issuing ethtool/netlink operations. Search for kernel oops, panic, BUG, KASAN, slab-use-after-free, or general protection fault messages that include virt_wifi, ethtool generic netlink functions, ethnl_ops_begin, ethnl_set_features, pm_runtime_get_sync, or __pm_runtime_resume. Investigate repeated interface creation/removal, ethtool feature changes against virtual Wi-Fi devices, crashes correlated with local user activity, or privileged containers granted network administration capabilities. Since no specific public exploit or actor activity is reported, detection should focus on behavioral evidence and crash signatures rather than fixed malware indicators.

• BUG: KASAN: slab-use-after-free in __pm_runtime_resume
• slab-use-after-free in __pm_runtime_resume
• __pm_runtime_resume+
• ethnl_ops_begin+
• ethnl_set_features+
• genl_family_rcv_msg_doit+
• genl_rcv_msg+
• netlink_sendmsg+
• wifi: virt_wifi
• virt_wifi
• SET_NETDEV_DEV
• pm_runtime_get_sync
• dev.parent
• KASAN: slab-use-after-free
• Read of size 2 at addr
• /sys/module/virt_wifi
• virt_wifi.ko

What your security team should do

• Prioritize kernel updates for shared Linux servers, developer workstations, virtualization hosts, CI runners, and container hosts where untrusted local users or workloads may execute code.
• Inventory systems with virt_wifi support enabled or loaded, and treat those as the highest-priority subset for remediation.
• Confirm patched systems have rebooted into the fixed kernel; track installed-versus-running kernel drift.
• Temporarily disable or block virt_wifi where it is not operationally required.
• Restrict CAP_NET_ADMIN and other network-administration privileges from untrusted users and containers.
• Monitor kernel logs for crash signatures involving virt_wifi, ethtool generic netlink, runtime power management, and KASAN use-after-free reports.
• Because EPSS is currently low, not KEV-listed, and no exploit maturity is reported, handle through normal kernel patch SLAs unless local multi-tenant or untrusted workload risk increases the exposure.