EN PT-BR
← Voltar ao feed
high

Public root exploit released for five-year-old Linux kernel virt_wifi use-after-free flaw (CVE-2026-31695)

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 04:17 · coletado há 1 hora

A use-after-free in the Linux kernel virt_wifi driver, tracked as CVE-2026-31695, has existed for nearly five years and lets an unprivileged local user gain root. Researcher Alexander Popov found and fixed the bug, then published a working exploit against a default Fedora 44 Server install on x86_64, documented in a PT SWARM write-up. Vendors disagree on severity: Amazon Linux rates it Important (CVSS v3 7.8) and Red Hat rates it Low. Before the research, AppSecure showed no public exploit, an EPSS of 0.01% and no CISA KEV entry, so the new exploit changes the risk picture. Multi-user servers, CI runners, shared hosting and container hosts are the highest-risk targets.

Entenda a falha

A vulnerabilidade

CVE-2026-31695 is a use-after-free (CWE-416) in the Linux kernel virt_wifi driver that gives an unprivileged local user root. The attacker needs a foothold on the host, such as a low-privileged shell, a compromised service account or code in a shared environment, but no user interaction. The bug is about five years old. Fixed kernels are 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22 and 6.19.12, or a distribution backport. Amazon Linux 2023 is affected (ALAS2023-2026-1681 and ALAS2023-2026-1746), while Amazon Linux 2 is listed as not affected. Vendors disagree on severity: Amazon rates it Important (CVSS v3 7.8) and Red Hat rates it Low.

Como funciona

A virt_wifi virtual network device is tied to the lower device beneath it, and the virtual device's parent pointer refers to that lower device. When the virtual device is torn down, its unregistration in netdev_run_todo() can run at the same time as the freeing of the lower device. The parent pointer is then left dangling. A later ethtool operation reaches ethnl_ops_begin(), which calls pm_runtime_get_sync() on dev->dev.parent. That call works on memory that has already been freed, and this is where the process goes wrong.

Por que é vulnerável

The root cause is a logic error in device lifetime management. The driver used SET_NETDEV_DEV(dev, &priv->lowerdev->dev) to make the lower device the parent of the virtual device. Nothing guaranteed that the lower device would outlive the virtual device during teardown, so the parent pointer could outlast the memory it pointed to. The upstream fix, titled "wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free", removes that call so the virtual device no longer holds the dangling parent reference. The bug stayed unnoticed for nearly five years, and it looked like a stability problem that depended on a tight race window.

Onde está

The virt_wifi driver, where the SET_NETDEV_DEV(dev, &priv->lowerdev->dev) call was removed by the upstream commit "wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free"; the dangling pointer is used in ethnl_ops_begin() and the teardown happens in netdev_run_todo().

Como foi descoberta

Researcher Alexander Popov found and fixed the bug. The articles do not say how he found it or when he reported it. The flaw reached the public through the upstream fix, the NVD entry and a PT SWARM write-up of his research, which includes a working exploit. Before that research, the AppSecure database showed no known public exploit, an EPSS score of 0.01% and no CISA KEV entry.

PoC pública

Alexander Popov published a working root exploit against a default Fedora 44 Server install on x86_64, documented in a PT SWARM write-up. He made the race window stable enough for practical use and used a spoofed struct device to get past the kernel's hardening and take full control of the system. This is a working exploit, not just a crash. Since it targets a mainstream distribution, defenders should not rely on the lower severity ratings and should patch hosts that run untrusted local code first. The poc_url is the gbhackers article that describes the exploit, not the PT SWARM write-up, whose address is not in the input.

Publicada em: gbhackers.com/5-year-old-linux-kernel-vulnerability/ ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 05:17.

Detalhes técnicos

  • The weakness is CWE-416 (Use After Free). The virt_wifi driver linked each virtual device to its lower device with SET_NETDEV_DEV(dev, &priv->lowerdev->dev);.
  • During teardown, unregistering a virt_wifi device in netdev_run_todo() can race with freeing of the lower device, leaving the virtual device's dev.parent pointer dangling.
  • A later ethtool operation reaches ethnl_ops_begin(), which calls pm_runtime_get_sync(dev->dev.parent) on the freed memory.
  • Popov made the race window stable enough for practical use and used a spoofed struct device to bypass kernel hardening and take full control of the system.
  • The impact is local privilege escalation. The attacker first needs a foothold such as a low-privileged shell, a compromised service account or code in a shared environment.
  • The article notes that kernel LPE bugs are already chained with other flaws, for example PHP2Shell with Fragnesia against PAN-OS, and that this bug could fill the same role.
  • Detection ideas: repeated creation and removal of virtual network devices, and unusual ethtool activity, which may indicate attempts to win the race.

Remediação

  • Upgrade to a fixed kernel: 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22 or 6.19.12, or to the distribution backport. The upstream fix is "wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free".
  • Amazon Linux 2023: apply ALAS2023-2026-1681 and ALAS2023-2026-1746. Amazon Linux 2 is listed as not affected.
  • Check the running kernel and driver presence with uname -r and lsmod | grep virt_wifi.
  • Where virt_wifi is not needed, blocklist the module (blacklist virt_wifi in /etc/modprobe.d/ and modprobe -r virt_wifi). This is the article author's suggestion, not an official vendor workaround.
  • Patch hosts that run untrusted local code first.

Linha do tempo

  1. gbhackers.com ↗ · pub. 03/11/2026 04:17 · coletado 03/11 05:00 primeiro registro

    Public root exploit released for five-year-old Linux kernel virt_wifi use-after-free flaw (CVE-2026-31695)

    ler a análise desta fonte

    A use-after-free in the Linux kernel virt_wifi driver, tracked as CVE-2026-31695, has existed for nearly five years and lets an unprivileged local user gain root. Researcher Alexander Popov found and fixed the bug, then published a working exploit against a default Fedora 44 Server install on x86_64, documented in a PT SWARM write-up. Vendors disagree on severity: Amazon Linux rates it Important (CVSS v3 7.8) and Red Hat rates it Low. Before the research, AppSecure showed no public exploit, an EPSS of 0.01% and no CISA KEV entry, so the new exploit changes the risk picture. Multi-user servers, CI runners, shared hosting and container hosts are the highest-risk targets.

    Technical Details

    • The weakness is CWE-416 (Use After Free). The virt_wifi driver linked each virtual device to its lower device with SET_NETDEV_DEV(dev, &priv->lowerdev->dev);.
    • During teardown, unregistering a virt_wifi device in netdev_run_todo() can race with freeing of the lower device, leaving the virtual device's dev.parent pointer dangling.
    • A later ethtool operation reaches ethnl_ops_begin(), which calls pm_runtime_get_sync(dev->dev.parent) on the freed memory.
    • Popov made the race window stable enough for practical use and used a spoofed struct device to bypass kernel hardening and take full control of the system.
    • The impact is local privilege escalation. The attacker first needs a foothold such as a low-privileged shell, a compromised service account or code in a shared environment.
    • The article notes that kernel LPE bugs are already chained with other flaws, for example PHP2Shell with Fragnesia against PAN-OS, and that this bug could fill the same role.
    • Detection ideas: repeated creation and removal of virtual network devices, and unusual ethtool activity, which may indicate attempts to win the race.

    Remediation

    • Upgrade to a fixed kernel: 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22 or 6.19.12, or to the distribution backport. The upstream fix is "wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free".
    • Amazon Linux 2023: apply ALAS2023-2026-1681 and ALAS2023-2026-1746. Amazon Linux 2 is listed as not affected.
    • Check the running kernel and driver presence with uname -r and lsmod | grep virt_wifi.
    • Where virt_wifi is not needed, blocklist the module (blacklist virt_wifi in /etc/modprobe.d/ and modprobe -r virt_wifi). This is the article author's suggestion, not an official vendor workaround.
    • Patch hosts that run untrusted local code first.