CVE-2026-31504: Linux Kernel use-after-free in packet_release via fanout race

CVE-2026-31504 · Severity: high · CVSS 7.8 · Published 2026-04-22

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system or potentially gain elevated privileges. The issue occurs during a specific sequence of network interface events that leaves the system in an unstable state. This affects various Linux-based systems, including certain industrial controllers from Siemens.

Technologies: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens.

Quick answers

Is CVE-2026-31504 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-31504 being exploited in the wild.
How severe is CVE-2026-31504?
High severity, with a CVSS score of 7.8, published 22 April 2026.
Which products and versions are affected?
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6.
Is there a fix for CVE-2026-31504?
A patch was published on 2026-03-23: Initial fix committed to mainline kernel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31504 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-31504?
Check whether you run Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in net/packet/af_packet.c due to a race condition in packet_release(). When a socket is being released, a concurrent NETDEV_UP event can trigger packet_notifier, which may re-register the socket into a fanout group's array via __fanout_link(). Because packet_release() fails to zero po->num while holding the bind_lock, the notifier incorrectly perceives the socket as still active. This re-registration occurs without incrementing the fanout group's reference count (f->sk_ref), leading to a dangling pointer in the fanout array after the socket is freed. A local attacker can exploit this race to trigger a UAF condition. The fix involves zeroing po->num within the bind_lock critical section in packet_release().

Affected products

  • Linux Linux Kernel Fixed in 42156f93d123436f2a27c468f18c966b7e5db796 and related stable backports
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-03-19: disclosed: Vulnerability reported/authored by Yochai Eisenrich
  • 2026-03-23: patched: Initial fix committed to mainline kernel
  • 2026-04-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.