---
id: CVE-2026-31516
title: 'xfrm: prevent policy_hthresh.work from racing with netns teardown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: prevent policy_hthresh.work from racing with netns teardown

  A XFRM_MSG_NEWSPDINFO request can queue the per-net work item
  policy_hthresh.work onto the system wor…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c <
    56ea2257b83ee29a543f158159e3d1abc1e3e4fe
  - >-
    Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c <
    8854e9367465d784046362698731c1111e3b39b8
  - >-
    Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c <
    4e2e77843fef473ef47e322d52436d8308582a96
  - >-
    Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c <
    29fe3a61bcdce398ee3955101c39f89c01a8a77e
  - Linux 3.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:10:33.949707Z'
published: '2026-04-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:14.411Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31516'
references:
  - url: 'https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe'
  - url: 'https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8'
  - url: 'https://git.kernel.org/stable/c/4e2e77843fef473ef47e322d52436d8308582a96'
  - url: 'https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e'
tags:
  - cve.org
epss: 0.00135
epssPercentile: 0.02661
ingestedAt: '2026-10-16T17:24:46.658Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: prevent policy_hthresh.work from racing with netns teardown

A XFRM_MSG_NEWSPDINFO request can queue the per-net work item
policy_hthresh.work onto the system workqueue.

The queued callback, xfrm_hash_rebuild(), retrieves the enclosing
struct net via container_of(). If the net namespace is torn down
before that work runs, the associated struct net may already have
been freed, and xfrm_hash_rebuild() may then dereference stale memory.

xfrm_policy_fini() already flushes policy_hash_work during teardown,
but it does not synchronize policy_hthresh.work.

Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the
queued work cannot outlive the net namespace teardown and access a
freed struct net.

## Affected

- `Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c < 56ea2257b83ee29a543f158159e3d1abc1e3e4fe`
- `Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c < 8854e9367465d784046362698731c1111e3b39b8`
- `Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c < 4e2e77843fef473ef47e322d52436d8308582a96`
- `Linux >= 880a6fab8f6ba5b5abe59ea68533202ddea1012c < 29fe3a61bcdce398ee3955101c39f89c01a8a77e`
- `Linux 3.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.