Skip to main content

Linux Kernel CVE-2026-31678

| EUVDEUVD-2026-25645 HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-04-25 Linux
Information Disclosure Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local UAF reachable only via OVS network-admin control, so AV:L/PR:L; winning the TOCTOU race is timing-dependent, so AC:H; kernel memory corruption yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:14 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25645
CVE Published
Apr 25, 2026 - 08:46 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: defer tunnel netdev_put to RCU release

ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev.

Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.

AnalysisAI

Local privilege escalation via a use-after-free race in the Linux kernel's Open vSwitch (openvswitch) module allows a local user with network-configuration capability to corrupt kernel memory. The flaw lives in ovs_netdev_tunnel_destroy(), which drops the tunnel netdev reference during teardown; when this runs after NETDEV_UNREGISTER has already detached the device, it races concurrent RCU readers that still observe vport->dev, producing a premature reference drop and stale-pointer access. The fix defers the netdev_put to the RCU release callback (vport_netdev_free), matching the non-tunnel path. There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 7th percentile).

Technical ContextAI

The affected component is the kernel's Open vSwitch datapath (net/openvswitch), specifically its netdev vport layer that wraps tunnel devices (e.g. VXLAN/GRE/Geneve) for the OVS flow pipeline. The bug is a CWE-367 time-of-check/time-of-use race between two teardown paths: the RTNL-serialized NETDEV_UNREGISTER notifier that detaches a device, and ovs_netdev_tunnel_destroy() which independently releases the vport->dev reference. Because OVS readers traverse vports under RCU, a reader can still hold a reference to vport->dev at the moment destroy drops it, yielding a use-after-free / reference-count imbalance on the net_device object. The corrected design centralizes the netdev_put into the RCU callback so the reference is only released after a grace period, guaranteeing no reader still observes the pointer.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0, whichever matches your branch - via the stable commits at git.kernel.org (e.g. https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc). Distribution users should apply their vendor kernel update and reboot; Ubuntu users follow USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1). Where immediate patching is not possible, the practical compensating control is to avoid exposing the openvswitch datapath to untrusted local principals: do not grant CAP_NET_ADMIN to untrusted containers/namespaces, and on hosts that do not require it, unload or blacklist the openvswitch module (modprobe -r openvswitch / blacklist openvswitch) - the trade-off is that this disables OVS-based networking, so it is only viable on hosts not using Open vSwitch. Restricting who can create/destroy OVS tunnel ports reduces the attack surface without a full patch but does not eliminate the race for legitimate admin users.

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31678 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy