VulnSocial

CVE-2026-31695PoC(linux / linux_kernel)

LOWCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for the virt_wifi net devices. However, unregistering a virt_wifi device in netdev_run_todo() can happen together with the device referenced by SET_NETDEV_DEV(). It can result in use-after-free during the ethtool operations performed on a virt_wifi device that is currently being unregistered. Such a net device can have the `dev.parent` field pointing to the freed memory, but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`. Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this: ================================================================== BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0 Read of size 2 at addr ffff88810cfc46f8 by task pm/606 Call Trace: <TASK> dump_stack_lvl+0x4d/0x70 print_report+0x170/0x4f3 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kasan_report+0xda/0x110 ? __pm_runtime_resume+0xe2/0xf0 ? __pm_runtime_resume+0xe2/0xf0 __pm_runtime_resume+0xe2/0xf0 ethnl_ops_begin+0x49/0x270 ethnl_set_features+0x23c/0xab0 ? __pfx_ethnl_set_features+0x10/0x10 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xf/0xf0 ? local_clock+0x10/0x30 ? kasan_save_track+0x25/0x60 ? __kasan_kmalloc+0x7f/0x90 ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0 genl_family_rcv_msg_doit+0x1e7/0x2c0 ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 ? __pfx_cred_has_capability.isra.0+0x10/0x10 ? stack_trace_save+0x8e/0xc0 genl_rcv_msg+0x411/0x660 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_ethnl_set_features+0x10/0x10 netlink_rcv_skb+0x121/0x380 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_down_read+0x10/0x10 genl_rcv+0x23/0x30 netlink_unicast+0x60f/0x830 ? __pfx_netlink_unicast+0x10/0x10 ? __pfx___alloc_skb+0x10/0x10 netlink_sendmsg+0x6ea/0xbc0 ? __pfx_netlink_sendmsg+0x10/0x10 ? __futex_queue+0x10b/0x1f0 ____sys_sendmsg+0x7a2/0x950 ? copy_msghdr_from_user+0x26b/0x430 ? __pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ___sys_sendmsg+0xf8/0x180 ? __pfx____sys_sendmsg+0x10/0x10 ? __pfx_futex_wait+0x10/0x10 ? fdget+0x2e4/0x4a0 __sys_sendmsg+0x11f/0x1c0 ? __pfx___sys_sendmsg+0x10/0x10 do_syscall_64+0xe2/0x570 ? exc_page_fault+0x66/0xb0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This fix may be combined with another one in the ethtool subsystem: https://lore.kernel.org/all/[email protected]/T/#u

linux CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-416

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • linux_kernel

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-08-02); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
linux
Products
linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-08-02: 1Mentions · 2026-10-21: 1Mentions · 2026-10-28: 1PoC Mentioned / Linked · 2026-08-02: 1Technical Details · 2026-10-21: 108-0210-2110-28
Signal classification3 categories
PoC
133.3%
Disclosure
133.3%
General
133.3%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-08-021
PoC1
2026-10-211
Disclosure1
2026-10-281
General1
Full discourse3 posts
  • Alexander Popov@a13xp0p0v
    PoC

    ⭐️My PoC exploit for CVE-2026-31695 in the Linux kernel is ready 🏁I managed to make it absolutely stable on Fedora 44 Server despite an elusive race condition during the exploitation 🛠This vuln existed for ≈5 years before I fixed it upstream ⚡️Gonna publish a detailed article! https://t.co/ZOhWLr1b6E

    Post summary

    The author announces a stable PoC exploit for CVE‑2026‑31695 in the Linux kernel and plans to publish a detailed article.

    41911775811.2K
    6.9K followersView on X
  • Alexander Popov@a13xp0p0v
    General

    Slides for my talk at @TheSAScon "Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device" https://a13xp0p0v.tech/img/Alexander_Popov-Dangerous_Device.pdf https://t.co/5oPZX8FS8r

    Post summary

    The tweet announces a presentation titled "Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device" and provides links to the slide PDF and tweet. No additional details such as proof of concept, exploit code, active exploitation reports, or patch information are included.

    2230110634.7K
    6.9K followersView on X
  • TheSAS2026@TheSAScon
    Disclosure

    Now, from mountains and steppes back to microcode and race conditions! Speaking of the latter, Alexander Popov (@a13xp0p0v) now dissects the anatomy of CVE-2026-31695 he discovered in the Linux Kernel. It sat there for 5 years and led to LPE. Interestingly, the exploit is very stable, which is not typical for ones involving race conditions. #TheSAS2026

    Post summary

    The text announces and discusses technical details of CVE-2026-31695, a race condition in the Linux Kernel leading to LPE, discovered by Alexander Popov and presented at TheSAS2026 conference, noting the exploit's unusual stability.

    10050519
    4.3K followersView on X
CPE platform detail8 entries

8 of 8 entries

PartVendorProductVersionTarget SWTarget HW
OSlinuxlinux_kernel---
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--
OSlinuxlinux_kernel7.0--

Explore more

Back to dashboardlinux CVEslinux_kernel vulnerabilities