CVE-2026-31406 xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
A race condition in the Linux kernel's xfrm module allows use-after-free, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31406?
CVE-2026-31406 is a high-severity use after free vulnerability in Linux kernel, published on 6 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
After cancel_delayed_work_sync() is called from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes remaining states via __xfrm_state_delete(), which calls xfrm_nat_keepalive_state_updated() to re-schedule nat_keepalive_work.
The following is a simple race scenario:
cpu0 cpu1
cleanup_net() [Round 1] ops_undo_list() xfrm_net_exit() xfrm_nat_keepalive_net_fini() cancel_delayed_work_sync(nat_keepalive_work); xfrm_state_fini() xfrm_state_flush() xfrm_state_delete(x) __xfrm_state_delete(x) xfrm_nat_keepalive_state_updated(x) schedule_delayed_work(nat_keepalive_work); rcu_barrier(); net_complete_free(); net_passive_dec(net); llist_add(&net->defer_free_list, &defer_free_list);
cleanup_net() [Round 2] rcu_barrier(); net_complete_free() kmem_cache_free(net_cachep, net); nat_keepalive_work() // on freed net
To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().
Which versions are affected by CVE-2026-31406?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31406?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31406 being exploited?
There is no known exploitation of CVE-2026-31406 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31406, DEBIAN-CVE-2026-31406, GHSA-pfp5-r4vh-w3r6, ROOT-OS-DEBIAN-13-CVE-2026-31406, UBUNTU-CVE-2026-31406.