Linux Kernel CVE-2026-31516

Requires local authenticated access with CAP_NET_ADMIN capability within a user namespace, achievable by unprivileged users in systems allowing unprivileged user namespace creation (kernel.unprivileged_userns_clone=1, default on many distributions). Attacker must trigger XFRM netlink messages (XFRM_MSG_NEWSPDINFO) which requires the XFRM subsystem to be compiled into the kernel (CONFIG_XFRM=y, nearly universal) and the ability to create/destroy network namespaces. Exploitation window depends on winning the race between namespace teardown completing struct net deallocation and the system workqueue executing the queued callback xfrm_hash_rebuild(). Race probability increases in environments with high namespace churn rates such as container orchestration platforms, CI/CD runners creating ephemeral containers, or OpenStack/KVM environments with frequent network namespace operations. Does not affect systems where unprivileged user namespaces are disabled or where XFRM is not compiled (rare). User interaction not required (UI:N) once attacker has local shell access.

Real-world exploitation risk is moderate despite high CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity and low privileges required, suggesting exploitation is technically feasible for authenticated local users. However, practical exploitation requires precise timing: an attacker must trigger XFRM_MSG_NEWSPDINFO to queue the work item, then force network namespace teardown before the callback executes, and win the race condition to achieve use-after-free. The EPSS score of 0.02% (5th percentile) reflects minimal observed exploitation attempts in the wild, consistent with the attack requiring kernel-level capabilities (CAP_NET_ADMIN in a user namespace) and containerized or virtualized environments where network namespaces are frequently created/destroyed. No CISA KEV listing and no public POC identified suggest this is not being actively exploited despite affecting kernels since version 3.18 (introduced in 2014). Priority is moderate: critical for containerized infrastructure (Kubernetes, Docker, OpenStack) where namespace churn is high and multiple tenants exist, but lower priority for traditional single-tenant systems. The availability of patches across all active stable kernel branches (6.12.80, 6.18.21, 6.19.11, 7.0) with upstream commits provides clear remediation path. Organizations running container orchestration platforms should prioritize patching; single-purpose appliances or non-containerized systems face lower immediate risk.

An authenticated local user with CAP_NET_ADMIN capability in a user namespace (common in unprivileged container environments) sends a crafted XFRM_MSG_NEWSPDINFO netlink message to queue policy_hthresh.work. The attacker immediately destroys the network namespace, triggering xfrm_policy_fini() teardown which frees the struct net. Before the queued work callback executes, the attacker sprays kernel memory to place controlled data at the freed struct net address. When xfrm_hash_rebuild() runs, it dereferences the attacker-controlled memory via container_of(), allowing arbitrary kernel code execution. No public POC exists at time of analysis, but the race window is widened in high-churn container environments (Kubernetes pod restarts, CI/CD pipelines).