# CVE-2026-31504: Linux Kernel use-after-free in packet_release via fanout race

Source: https://junglewise.ai/threats/cve-2026-31504-linux-kernel-use-after-free-in-packet-release-via-fanout-race  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-31504 · Severity: high · CVSS 7.8 · Published 2026-04-22

A vulnerability in the Linux kernel's networking component could allow a local user to crash the system or potentially gain elevated privileges. The issue occurs during a specific sequence of network interface events that leaves the system in an unstable state. This affects various Linux-based systems, including certain industrial controllers from Siemens.

Technologies: [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp), [Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/siplus-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-31504 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31504 being exploited in the wild.

**How severe is CVE-2026-31504?** High severity, with a CVSS score of 7.8, published 22 April 2026.

**Which products and versions are affected?** Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6.

**Is there a fix for CVE-2026-31504?** A patch was published on 2026-03-23: Initial fix committed to mainline kernel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31504 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-31504?** Check whether you run Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP or Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in net/packet/af_packet.c due to a race condition in packet_release(). When a socket is being released, a concurrent NETDEV_UP event can trigger packet_notifier, which may re-register the socket into a fanout group's array via __fanout_link(). Because packet_release() fails to zero po->num while holding the bind_lock, the notifier incorrectly perceives the socket as still active. This re-registration occurs without incrementing the fanout group's reference count (f->sk_ref), leading to a dangling pointer in the fanout array after the socket is freed. A local attacker can exploit this race to trigger a UAF condition. The fix involves zeroing po->num within the bind_lock critical section in packet_release().

## Affected products

- Linux Linux Kernel Fixed in 42156f93d123436f2a27c468f18c966b7e5db796 and related stable backports
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

## Timeline

- 2026-03-19: disclosed: Vulnerability reported/authored by Yochai Eisenrich
- 2026-03-23: patched: Initial fix committed to mainline kernel
- 2026-04-22: advisory: NVD publication date

## References

- [https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9](https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9)
- [https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796](https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796)
- [https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e](https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e)
- [https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b](https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b)
- [https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b](https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b)
- [https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1](https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1)
- [https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6](https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6)

## Related threats

- [Linux Kernel denial of service in IPv6 tunneled traffic handling](https://junglewise.ai/threats/cve-2026-43057-linux-kernel-denial-of-service-in-ipv6-tunneled-traffic-handling)
- [Linux Kernel information leak in IPv6 ndisc nduseroptmsg](https://junglewise.ai/threats/cve-2026-43040-linux-kernel-information-leak-in-ipv6-ndisc-nduseroptmsg)
- [Linux kernel information leak in tc_chain_fill_node](https://junglewise.ai/threats/cve-2026-43035-linux-kernel-information-leak-in-tc-chain-fill-node)
- [Linux Kernel memory corruption in crypto authencesn decryption](https://junglewise.ai/threats/cve-2026-43033-linux-kernel-memory-corruption-in-crypto-authencesn-decryption)
- [Linux Kernel BPF verifier incorrect state pruning in regsafe](https://junglewise.ai/threats/cve-2026-43030-linux-kernel-bpf-verifier-incorrect-state-pruning-in-regsafe)