HIGH
packet Fanout UAF
CVE-2026-31504
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the socket in `sklist` can re-register the hook. For fanout sockets, this re-registration calls `__fanout_link(sk, po)` which adds the socket back into `f->arr[]` and increments `f->num_members`, but does NOT increment `f->sk_ref`. The fix sets `po->num` to zero in `packet_release` while `bind_lock` is held to prevent NETDEV_UP from linking, preventing the race window. This bug was found following an additional audit with Claude Code based on CVE-2025-38617.
02KernelScan AI Analysis
Risk summary
An attacker with local access can trigger a use-after-free vulnerability in the packet socket fanout mechanism by exploiting a race condition during socket cleanup. This could lead to kernel memory corruption, system crashes, or potential privilege escalation through careful heap manipulation.
Vulnerability analysis
Root Cause: A race condition exists in packet_release() where NETDEV_UP events can re-register a socket into a fanout group's array after the socket has begun cleanup but before po->num is zeroed. The socket remains in the global sklist during cleanup, allowing packet_notifier(NETDEV_UP) to find it and call __fanout_link() which adds the socket back to f->arr[] without incrementing f->sk_ref, creating a dangling pointer when the socket is fully freed.
Attack Surface: Local attack surface requiring the ability to create AF_PACKET sockets with fanout groups and trigger network device state changes. The vulnerability requires specific timing between socket cleanup and NETDEV_UP events, making it a timing-dependent race condition.
Fix Mechanism: The patch adds 'WRITE_ONCE(po->num, 0);' inside the bind_lock critical section in packet_release(). By zeroing po->num while holding the lock, it prevents NETDEV_UP from re-registering the socket since the protocol number check will fail, closing the race window.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.253 | ee642b1962ca |
| 5.15 | 5.15.203 | 42cfd7898eee |
| 6.1 | 6.1.168 | 1b4c03f8892d |
| 6.12 | 6.12.80 | 75fe6db23705 |
| 6.18 | 6.18.21 | d0c7cdc15fdf |
| 6.19 | 6.19.11 | ceccbfc6de72 |
| 6.6 | 6.6.131 | 654386baef22 |
| mainline | 7.0 | 42156f93d123 |