Race Condition in Packet Management of Linux Kernel

CVE-2026-31504

What is CVE-2026-31504?

A race condition exists in the Linux kernel's packet_release() function, where the NETDEV_UP event can incorrectly re-register a socket in the fanout group's array. This leads to a dangling pointer, as the re-registration is not properly cleaned up. As a result, a concurrent packet_notifier could inadvertently link sockets back into the array, causing inconsistencies and potential security implications. The vulnerability has been addressed by ensuring that the socket count is reset correctly while holding the necessary lock, thus eliminating the race condition.

References