Linux Kernel CVE-2026-31504

This vulnerability affects the Linux kernel's AF_PACKET socket implementation, specifically the packet fanout mechanism used for load-balancing packet capture across multiple sockets. Fanout groups maintain an array of member sockets for distributing packets. The race condition occurs during socket cleanup in packet_release() when it releases the bind_lock before zeroing po->num (the protocol number field). If a NETDEV_UP network device notification arrives during this window, the packet_notifier() function can call __fanout_link() to re-register the socket into the fanout array. This creates a use-after-free condition because the socket is simultaneously being released while being added back to active data structures. The fanout reference counting becomes inconsistent (f->num_members incremented but f->sk_ref not incremented), leading to potential memory corruption. The vulnerability was introduced in commit ce06b03e60fc and affects kernel versions from 3.1 onward until patched. The fix addresses the root cause by setting po->num to zero within the bind_lock critical section, preventing the notification handler from identifying the socket as eligible for re-registration.