CVE-2026-31579

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31579", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.119Z", "datePublished": "2026-04-24T14:42:10.208Z", "dateUpdated": "2026-11-05T21:45:09.029Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:33.170Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback. This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd ->exit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg->creating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net->user_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireguard/device.c"], "versions": [{"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "707607db2193591b68c0e70f814133472c185b1e", "status": "affected", "versionType": "git"}, {"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "9a9e69155b2091b8297afaf1533b8d68a3096841", "status": "affected", "versionType": "git"}, {"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "1c52ef00e391144334f10995985c2f256d4be982", "status": "affected", "versionType": "git"}, {"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "a1d0f6cbb962af29586e3e65a4bced1a5e39221f", "status": "affected", "versionType": "git"}, {"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "60a25ef8dacb3566b1a8c4de00572a498e2a3bf9", "status": "affected", "versionType": "git"}, {"version": "363cc6efdbb54bb06cd5034a69b41aae974a736f", "status": "affected", "versionType": "git"}, {"version": "5.7.7", "lessThan": "5.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireguard/device.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e"}, {"url": "https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841"}, {"url": "https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982"}, {"url": "https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f"}, {"url": "https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}], "title": "wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31579", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:40.854579Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:09.029Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31579", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:40.854579Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:39:42.720Z"}}], "cna": {"title": "wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "707607db2193591b68c0e70f814133472c185b1e", "versionType": "git"}, {"status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "9a9e69155b2091b8297afaf1533b8d68a3096841", "versionType": "git"}, {"status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "1c52ef00e391144334f10995985c2f256d4be982", "versionType": "git"}, {"status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "a1d0f6cbb962af29586e3e65a4bced1a5e39221f", "versionType": "git"}, {"status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "lessThan": "60a25ef8dacb3566b1a8c4de00572a498e2a3bf9", "versionType": "git"}, {"status": "affected", "version": "363cc6efdbb54bb06cd5034a69b41aae974a736f", "versionType": "git"}, {"status": "affected", "version": "5.7.7", "lessThan": "5.8", "versionType": "semver"}], "programFiles": ["drivers/net/wireguard/device.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireguard/device.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e"}, {"url": "https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841"}, {"url": "https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982"}, {"url": "https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f"}, {"url": "https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback. This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd ->exit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg->creating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net->user_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.24", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.14", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.1", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.7.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:33.170Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31579", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:09.029Z", "dateReserved": "2026-03-09T15:48:24.119Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:42:10.208Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireguard/device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "707607db2193591b68c0e70f814133472c185b1e", "status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "versionType": "git"}, {"lessThan": "9a9e69155b2091b8297afaf1533b8d68a3096841", "status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "versionType": "git"}, {"lessThan": "1c52ef00e391144334f10995985c2f256d4be982", "status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "versionType": "git"}, {"lessThan": "a1d0f6cbb962af29586e3e65a4bced1a5e39221f", "status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "versionType": "git"}, {"lessThan": "60a25ef8dacb3566b1a8c4de00572a498e2a3bf9", "status": "affected", "version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0", "versionType": "git"}, {"status": "affected", "version": "363cc6efdbb54bb06cd5034a69b41aae974a736f", "versionType": "git"}, {"lessThan": "5.8", "status": "affected", "version": "5.7.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireguard/device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7BFA239-2F39-4B24-92AA-6F60AA187C18", "versionEndExcluding": "6.18.24", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback. This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd ->exit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg->creating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net->user_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwireguard: dispositivo: usar la devoluci\u00f3n de llamada exit_rtnl en lugar de rtnl_lock manual en pre_exit\n\nwg_netns_pre_exit() adquiere manualmente rtnl_lock() dentro de la devoluci\u00f3n de llamada .pre_exit de pernet. Esto causa una tarea colgada cuando otro hilo mantiene rtnl_mutex - la cola de trabajo cleanup_net (o la ruta de reversi\u00f3n de fallos de setup_net) se bloquea indefinidamente en wg_netns_pre_exit() esperando adquirir el bloqueo.\n\nConvertir a .exit_rtnl, introducido en el commit 7a60d91c690b (\u2019net: A\u00f1adir el hook -> exit_rtnl() a la estructura pernet_operations.\u2019), donde el framework ya mantiene RTNL y agrupa todas las devoluciones de llamada bajo un \u00fanico par rtnl_lock()/rtnl_unlock(), eliminando la ventana de contenci\u00f3n.\n\nEl rcu_assign_pointer(wg -> creating_net, NULL) es seguro moverlo de .pre_exit a .exit_rtnl (que se ejecuta despu\u00e9s de synchronize_rcu()) porque todos los lectores RCU de creating_net o usan maybe_get_net() - que devuelve NULL para un espacio de nombres moribundo con recuento de referencias cero - o acceden a net -> user_ns que permanece v\u00e1lido durante toda la secuencia ops_undo_list.\n\n[ Jason: a\u00f1adi\u00f3 las anotaciones __net_exit y __read_mostly que faltaban. ]"}], "id": "CVE-2026-31579", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31579", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:39:40.854579Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:32.587", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit", "id": "2461496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461496"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel's WireGuard component. A local user could trigger a hung task by causing contention for the `rtnl_lock()` within the `wg_netns_pre_exit()` callback. This issue can lead to a Denial of Service (DoS), where the system becomes unresponsive as cleanup operations block indefinitely."], "name": "CVE-2026-31579", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31579\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31579\nhttps://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31579-3f05@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[900575aa33a3eaaef802b31de187a85c4a4b4bd0,9a9e69155b2091b8297afaf1533b8d68a3096841)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[900575aa33a3eaaef802b31de187a85c4a4b4bd0,1c52ef00e391144334f10995985c2f256d4be982)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[900575aa33a3eaaef802b31de187a85c4a4b4bd0,a1d0f6cbb962af29586e3e65a4bced1a5e39221f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[900575aa33a3eaaef802b31de187a85c4a4b4bd0,60a25ef8dacb3566b1a8c4de00572a498e2a3bf9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "363cc6efdbb54bb06cd5034a69b41aae974a736f"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.1,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.1-rc1"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:16:30.294395+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that includes the patch fixing the WireGuard namespace cleanup deadlock (the commit that replaces manual rtnl_lock with .exit_rtnl).", "Reboot or reload the kernel to activate the updated code.", "Restrict the creation and deletion of network namespaces to trusted users or administrative accounts to reduce the attack surface until the kernel update can be applied."], "summary": {"action": "Apply Patch", "impact": "Denial of Service (service hang)"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to the Linux kernel, affecting all distributions that ship the kernel code unchanged and lack the patch that replaces the manual rtnl_lock with the .exit_rtnl hook introduced in commit 7a60d91c690b. Vendor and product names are simply Linux: Linux. No specific affected kernel versions are listed in the CNA data; the issue exists in any kernel build containing the unpatched pernet .pre_exit implementation.", "description_and_impact": "The bug in the Linux kernel's WireGuard network namespace cleanup path introduces a deadlock by manually acquiring the rtnl_lock during the .pre_exit callback. This locking strategy causes any thread holding the rtnl_mutex\u2014such as the cleanup_net workqueue or rollback paths\u2014to block indefinitely, leading to a hung task. The result is a denial-of-service condition that can stall kernel operations within the affected namespace, potentially affecting system responsiveness or availability.", "risk_and_exploitability": "The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to trigger the namespace exit sequence while another process holds the rtnl_mutex, which generally requires local privileged (root) access or the ability to create and delete network namespaces. The fix relies on a standard kernel update that removes the manual lock and uses the framework\u2011provided .exit_rtnl hook, eliminating the contention window."}}}}, "created": "2026-04-27T19:00:15.710623+00:00", "updated": "2026-04-28T20:30:06.169484+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}