Skip to main content

Linux Kernel CVE-2026-31508

| EUVDEUVD-2026-24887 HIGH
Race Condition (CWE-362)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Race Condition Dell Canonical
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local authenticated access
  2. Delivery
    Obtain network admin capabilities
  3. Exploit
    Initiate OVS port deletion
  4. Execution
    Trigger preemption during teardown
  5. Persist
    Cause use-after-free in dev_set_promiscuity
  6. Impact
    Kernel panic/system crash

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

PREEMPT_RT real-time kernel configuration must be enabled (not default on most distributions). Open vSwitch kernel module must be loaded and active with configured virtual network ports. Attacker requires local authenticated access with sufficient privileges to delete network interfaces (CAP_NET_ADMIN capability or equivalent). Exploitation depends on winning a specific race condition during OVS port teardown when ovs_netdev_detach_dev() is preempted after clearing the IFF_OVS_DATAPATH flag but before completing unregistration. Standard non-RT Linux kernels are significantly less vulnerable due to different preemption characteristics. Attack vector is local (AV:L) requiring low privileges (PR:L) with no user interaction (UI:N) but attack complexity is low (AC:L) once prerequisites are met.
Impact

Real-world risk is moderate despite CVSS 7.8 rating. The CVSS vector (AV:L/AC:L/PR:L/UI:N) correctly indicates local authenticated access with low attack complexity, meaning attackers need existing system access and privileges to manage network interfaces. However, multiple factors significantly reduce actual risk: (1) EPSS score of 0.02% (7th percentile) indicates security researchers assess exploitation probability as very low in real-world environments; (2) Vulnerability requires PREEMPT_RT kernel configuration, which is not default on most Linux distributions and primarily used in specialized real-time systems; (3) Triggering requires precise timing during OVS port deletion operations, making reliable exploitation challenging even on RT kernels; (4) Patches are widely available across all maintained stable kernel branches (5.10.x through 7.0); (5) No KEV listing and no public exploit code identified. The high CVSS score reflects potential for privilege escalation to kernel panic/DoS if exploited, but practical exploitation barriers are substantial. This is a priority for real-time Linux deployments using Open vSwitch, but lower priority for standard server/desktop configurations. The availability of patches across eight stable kernel versions indicates vendor awareness and comprehensive fix coverage.
Exploit ScenarioDerived

A local attacker with low-level privileges to manage network interfaces on a PREEMPT_RT Linux system running Open vSwitch initiates deletion of an OVS port using standard networking tools (ip link delete). During the teardown process, they trigger the race condition by timing the operation to cause kernel preemption after the IFF_OVS_DATAPATH flag is cleared but before unregistration completes. The netdev structure is freed prematurely via call_rcu(), and subsequent access in dev_set_promiscuity() triggers a general protection fault, causing kernel panic and system-wide denial of service. No public exploit code exists, but the attack is straightforward for an authenticated user with network administration capabilities on vulnerable RT kernel configurations.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 27, 2026

Use-after-free in Linux kernel Open vSwitch module causes system crash when deleting network interfaces on PREEMPT_RT kernels. The vulnerability is confirmed patched in multiple stable kernel versions (5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0) with upstream fixes available via kernel.org commits. EPSS score of 0.02% (7th percentile) indicates very low exploitation likelihood. No active exploitation confirmed (not in CISA KEV). Local authenticated access required (CVSS AV:L/PR:L) with high impact (CVSS 7.8), but exploitation depends on PREEMPT_RT kernel configuration and specific Open vSwitch teardown race conditions.

RemediationAI

Upgrade to patched Linux kernel versions: 5.10.253 or later for 5.10.x branch, 5.15.203 or later for 5.15.x, 6.1.168 or later for 6.1.x, 6.6.131 or later for 6.6.x, 6.12.80 or later for 6.12.x, 6.18.21 or later for 6.18.x, 6.19.11 or later for 6.19.x, or 7.0 for mainline. Upstream patches are available at https://git.kernel.org/stable/c/33609454be4f582e686a4bf13d4482a5ca0f6c4b and related commits listed in references. For systems that cannot immediately patch, specific compensating controls include: (1) Avoid using PREEMPT_RT kernel configurations if real-time performance is not required (trade-off: loss of deterministic latency guarantees); (2) Minimize dynamic OVS port deletion operations during production workloads, instead performing network topology changes during maintenance windows (trade-off: reduced operational flexibility); (3) If using Open vSwitch on RT kernels, implement monitoring for kernel panics and general protection faults in the dev_set_promiscuity path to detect exploitation attempts (detection only, not prevention). Note that disabling Open vSwitch entirely eliminates the vulnerability but breaks network virtualization functionality for containers and VMs. Vendor advisories are available from Dell and Canonical per the tags.

Affected VersionsENISA

Linux 5498227676303e3ffa9a3a46214af96bc3e81314 <755a6300afbd743cda4b102f24f343380ec0e0ff
Linux patch: 6.19.11
Linux patch: 0
Linux patch: 5.15.203
Linux 0fc642f011cb7a7eff41109e66d3b552e9f4d795 <4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8
Linux 5498227676303e3ffa9a3a46214af96bc3e81314 <7c770dadfda5cbbde6aa3c4363ed513f1d212bf8
Linux patch: 6.6.131
Linux patch: 5.10.253
Linux patch: 6.12.80
Linux 6.19
Linux patch: 6.1.168
Linux 5116f61ab11846844585c9082c547c4ccd97ff1a <43579baa17270aa51f93eb09b6e4af6e047b7f6e
Linux f31557fb1b35332cca9994aa196cef284bcf3807 <95265232b49765a4d00f4d028c100bb7185600f4
Linux patch: 7.0
Linux patch: 6.18.21
Linux b823c3344d5446b720227ba561df10a4f0add515 <df3c95be76103604e752131d9495a24814915ece
Linux c98263d5ace597c096a7a60aeef790da7b54979e <5fdeaf591a0942772c2d18ff3563697a49ad01c6
Linux 052e5db5be4576e0a8ef1460b210da5f328f4cd1 <33609454be4f582e686a4bf13d4482a5ca0f6c4b

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This is a race condition vulnerability in the Linux kernel's Open vSwitch (OVS) network virtualization subsystem, specifically in the netdev teardown path. The bug was introduced when OVS port teardown code was modified to conditionally use RTNL locking. In ovs_netdev_detach_dev(), the IFF_OVS_DATAPATH flag is cleared on the network device before unregistration completes. On PREEMPT_RT kernels (real-time Linux), preemption can occur after flag clearing, allowing netdev_destroy() to proceed immediately to call_rcu() and free the device while unregistration is still in progress. When the teardown code subsequently calls dev_set_promiscuity() on the freed netdev structure, it triggers a general protection fault accessing invalid memory (0xff00000001000239). The vulnerability affects the net/openvswitch subsystem interaction with core networking device management code. The affected versions span from commit 5498227676303e3ffa9a3a46214af96bc3e81314 through multiple stable kernel branches before respective patches were applied.

Know when Dell gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.0 HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Apr 28, 2026 - 15:04 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 22, 2026 - 16:33 EUVD
CVE Published
Apr 22, 2026 - 14:16 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: Avoid releasing netdev before teardown completes

The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation if the IFF_OVS_DATAPATH flag is already cleared on the netdev.

The ovs_netdev_detach_dev() function clears the flag before completing the unregistration, and if it gets preempted after clearing the flag (as can happen on an -rt kernel), netdev_destroy() can complete and the device can be freed before the unregistration completes. This leads to a splat like:

[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 [ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 [ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 [ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 [ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 [ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 [ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 [ 998.393944] PKRU: 55555554 [ 998.393946] Call Trace: [ 998.393949] <TASK> [ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] [ 998.394009] ? __die_body.cold+0x8/0x12 [ 998.394016] ? die_addr+0x3c/0x60 [ 998.394027] ? exc_general_protection+0x16d/0x390 [ 998.394042] ? asm_exc_general_protection+0x26/0x30 [ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 [ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] [ 998.394092] dp_device_event+0x41/0x80 [openvswitch] [ 998.394102] notifier_call_chain+0x5a/0xd0 [ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 [ 998.394110] rtnl_dellink+0x169/0x3e0 [ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 [ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 [ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 [ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 998.394132] netlink_rcv_skb+0x50/0x100 [ 998.394138] netlink_unicast+0x292/0x3f0 [ 998.394141] netlink_sendmsg+0x21b/0x470 [ 998.394145] ____sys_sendmsg+0x39d/0x3d0 [ 998.394149] ___sys_sendmsg+0x9a/0xe0 [ 998.394156] __sys_sendmsg+0x7a/0xd0 [ 998.394160] do_syscall_64+0x7f/0x170 [ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 998.394165] RIP: 0033:0x7fad61bf4724 [ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 [ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 [ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 [ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f [ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2 ---truncated---

Executive ViewAI

Why It Matters

CVE-2026-31508 is a use-after-free vulnerability in the Linux kernel's Open vSwitch module that can cause system crashes on PREEMPT_RT-enabled systems when network interfaces are deleted. This affects organizations running PREEMPT_RT kernels with Open vSwitch, potentially causing denial of service through local authenticated access; patched kernel versions are available and should be prioritized for systems with strict real-time requirements.

Business Impact: Medium
Compensating Controls

Apply vendor patch. Interim mitigations include restricting local authenticated user access to systems where PREEMPT_RT and Open vSwitch are both enabled, implementing access controls on network interface management commands, and scheduling patching during maintenance windows for systems that cannot be immediately updated.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Threat Intel
2
1 source
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

More in Dell

View all
CVE-2012-2962 MEDIUM POC
6.5 Jul 30

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

CVE-2014-8420 CRITICAL POC
9.0 Nov 25

The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
CVE-2012-3951 HIGH POC
7.5 Jul 31

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
CVE-2014-4977 MEDIUM POC
6.5 Jul 16

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute

CVE-2026-22769 CRITICAL
10.0 Feb 17

Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
CVE-2014-125113 CRITICAL POC
9.3 Aug 05

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
CVE-2012-2626 MEDIUM POC
5.0 Jul 31

cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
CVE-2014-8272 MEDIUM POC
5.0 Dec 19

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57

CVE-2016-9683 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2016-9682 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
CVE-2016-9684 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2017-10955 HIGH
8.8 Oct 19

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-31508 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/358871 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/33609454be4f582e686a4bf13d4482a5ca0f6c4b REF https://git.kernel.org/stable/c/43579baa17270aa51f93eb09b6e4af6e047b7f6e REF https://git.kernel.org/stable/c/4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8 REF https://git.kernel.org/stable/c/5fdeaf591a0942772c2d18ff3563697a49ad01c6 REF https://git.kernel.org/stable/c/755a6300afbd743cda4b102f24f343380ec0e0ff REF https://git.kernel.org/stable/c/7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 REF https://git.kernel.org/stable/c/95265232b49765a4d00f4d028c100bb7185600f4 REF https://git.kernel.org/stable/c/df3c95be76103604e752131d9495a24814915ece

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy