Junglewise Threat Intelligence

CVE-2026-31504: Linux Kernel use-after-free in packet_release via fanout race

CVE-2026-31504 · Severity: high · CVSS 7.8 · Published 2026-04-22

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system or potentially gain elevated privileges. The issue occurs during a specific sequence of network interface events that leaves the system in an unstable state. This affects various Linux-based systems, including certain industrial controllers from Siemens.

Technical details

A use-after-free (UAF) vulnerability exists in net/packet/af_packet.c due to a race condition in packet_release(). When a socket is being released, a concurrent NETDEV_UP event can trigger packet_notifier, which may re-register the socket into a fanout group's array via __fanout_link(). Because packet_release() fails to zero po->num while holding the bind_lock, the notifier incorrectly perceives the socket as still active. This re-registration occurs without incrementing the fanout group's reference count (f->sk_ref), leading to a dangling pointer in the fanout array after the socket is freed. A local attacker can exploit this race to trigger a UAF condition. The fix involves zeroing po->num within the bind_lock critical section in packet_release().

Affected products

  • Linux Linux Kernel Fixed in 42156f93d123436f2a27c468f18c966b7e5db796 and related stable backports
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-03-19: disclosed: Vulnerability reported/authored by Yochai Eisenrich
  • 2026-03-23: patched: Initial fix committed to mainline kernel
  • 2026-04-22: advisory: NVD publication date

References

Related threats