Linux Kernel Vulnerability in Networking Management by Linux Foundation

CVE-2026-31516

What is CVE-2026-31516?

In the Linux kernel, a race condition vulnerability could occur during the processing of XFRM_MSG_NEWSPDINFO requests. When these requests queue the per-net work item policy_hthresh.work onto the system workqueue, there is a risk that the associated networking namespace could be torn down before the queued work executes. If this occurs, the xfrm_hash_rebuild() function may dereference a structure that has already been freed, leading to potential system instability and corruption. To address this vulnerability, the synchronization of policy_hthresh.work with the teardown process of the network namespace is essential, ensuring that queued work does not run after the associated structure has been deallocated.

References