{"id":"CVE-2026-31579","title":"wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callbac…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 707607db2193591b68c0e70f814133472c185b1e","Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 9a9e69155b2091b8297afaf1533b8d68a3096841","Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 1c52ef00e391144334f10995985c2f256d4be982","Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < a1d0f6cbb962af29586e3e65a4bced1a5e39221f","Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","Linux 363cc6efdbb54bb06cd5034a69b41aae974a736f","Linux >= 5.7.7 < 5.8","Linux 5.8"],"published":"2026-04-24","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:39:33.170Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31579","references":[{"url":"https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e"},{"url":"https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841"},{"url":"https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982"},{"url":"https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f"},{"url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"}],"tags":["cve.org"],"epss":0.00162,"epssPercentile":0.04997,"ingestedAt":"2026-10-21T12:48:53.662Z","slug":"CVE-2026-31579","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback.  This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd ->exit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg->creating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net->user_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]\n\n## Affected\n\n- `Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 707607db2193591b68c0e70f814133472c185b1e`\n- `Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 9a9e69155b2091b8297afaf1533b8d68a3096841`\n- `Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 1c52ef00e391144334f10995985c2f256d4be982`\n- `Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < a1d0f6cbb962af29586e3e65a4bced1a5e39221f`\n- `Linux >= 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 60a25ef8dacb3566b1a8c4de00572a498e2a3bf9`\n- `Linux 363cc6efdbb54bb06cd5034a69b41aae974a736f`\n- `Linux >= 5.7.7 < 5.8`\n- `Linux 5.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}