CVE-2026-31678 Details
Description
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev. Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.
A vulnerability in the Linux kernel's Open vSwitch component relates to improper management of network device references in tunnel destruction routines. Specifically, the function 'ovs_netdev_tunnel_destroy()' may execute after the network device has already been detached, leading to a race condition. This issue can cause the netdev reference to be dropped prematurely, creating a conflict with other processes that still reference the virtual port's device. The vulnerability affects the Linux kernel stable tree.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is '42f0d3d81209654c08ffdde5a34b9b92d2645896', which is included in the official Linux kernel repositories.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c | kernel.org | Patch |
| https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab | kernel.org | Patch |
| https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc | kernel.org | Patch |
| https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.3, < 6.1.168 >= 6.2, < 6.6.131 >= 6.7, < 6.12.80 >= 6.13, < 6.18.21 >= 6.19, < 6.19.11 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 6, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | kernel.org |
| Apr 25, 2026 | New CVE Received | kernel.org |