CVE-2026-31695: Linux kernel flaw gives local user root
Researcher Alexander Popov disclosed CVE-2026-31695, a use-after-free in the Linux kernel network device management code, present for nearly five years. An unprivileged local user can escalate to root by exploiting a race between unregistering a network interface and simultaneously accessing it via the ethtool netlink interface. The source cites no available fix and no exploitation in the wild; restrict local accounts and watch for a kernel update.
What happened
Researcher Alexander Popov disclosed CVE-2026-31695, a flaw in the Linux kernel that lets an unprivileged local user gain full (root) access. According to the source, the flaw sits in the network device management code and has existed for nearly five years.
Why it matters
The flaw is exploitable by anyone who already has a local account on the machine, such as employees, compromised services, or attackers who got in another way. With root, the attacker controls the system, accesses data, and erases traces. Linux servers with many users or service accounts are the most exposed.
What to do
Restrict local accounts and privileges on Linux machines and watch for the kernel fix. Apply the distribution update as soon as it is available.
For the technical team
- CVE
- CVE-2026-31695
- Affected
- Kernel Linux (gestão de dispositivos de rede) · Linux kernel. The source says the flawed code has been present for nearly five years but lists no affected versions.
- Exploitation
- Disclosed by researcher Alexander Popov. The source describes the exploitation mechanics but cites no public PoC and no in-the-wild exploitation.
- Fix
- The source cites no fixed version, patch, or mitigation.
- Vector
- Use-after-free in kernel network device management, requiring an unprivileged local user. One thread removes the parent interface veth1 via the RTM_DELLINK message; netdev_run_todo frees the net_device struct of veth1. Concurrently, another thread runs ETHTOOL_MSG_FEATURES_SET on the child interface virt_wifi0; ethnl_ops_begin calls pm_runtime_get_sync(dev->dev.parent), whose pointer targets a struct device inside the already freed memory. The function reads and writes freed memory, providing the exploitation primitive.
- More details
- Exploited via type confusion: attacker-controlled data is allocated in the same freed memory region (kmalloc-cg-4k) and interpreted as a fake struct device operated on by pm_runtime_get_sync. The source says the attacker bypasses the CONFIG_SLAB_BUCKETS and CONFIG_RANDOM_KMALLOC_CACHES protections, which make heap spraying and controlled object reallocation harder. A cross-cache attack was not viable because the race window was too short. The source text is truncated at the end.
Timeline
Incident opened.
Sources 1 source
- @ptdbugs @ptdbugs
