---
id: CVE-2026-31678
title: 'openvswitch: defer tunnel netdev_put to RCU release'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  openvswitch: defer tunnel netdev_put to RCU release

  ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
  detached the device. Dropping the netdev refere…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a9020fde67a6eb77f8130feff633189f99264db1 <
    9d56aced21fb9c104e8a3f3be9b21fbafe448ffc
  - >-
    Linux >= a9020fde67a6eb77f8130feff633189f99264db1 <
    42f0d3d81209654c08ffdde5a34b9b92d2645896
  - >-
    Linux >= a9020fde67a6eb77f8130feff633189f99264db1 <
    bbe7bd722bfaea36aab3da6cc60fb4a05c644643
  - >-
    Linux >= a9020fde67a6eb77f8130feff633189f99264db1 <
    98b726ab5e2a4811e27c28e4d041f75bba147eab
  - >-
    Linux >= a9020fde67a6eb77f8130feff633189f99264db1 <
    b8c56a3fc5d879c0928f207a756b0f067f06c6a8
  - >-
    Linux >= a9020fde67a6eb77f8130feff633189f99264db1 <
    6931d21f87bc6d657f145798fad0bf077b82486c
  - Linux 4.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:12:17.787623Z'
published: '2026-04-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:23.572Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31678'
references:
  - url: 'https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc'
  - url: 'https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896'
  - url: 'https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643'
  - url: 'https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab'
  - url: 'https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8'
  - url: 'https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c'
tags:
  - cve.org
epss: 0.00102
epssPercentile: 0.00872
ingestedAt: '2026-10-16T17:24:46.670Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: defer tunnel netdev_put to RCU release

ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in destroy can race
with concurrent readers that still observe vport->dev.

Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let
vport_netdev_free() drop the reference from the RCU callback, matching
the non-tunnel destroy path and avoiding additional synchronization
under RTNL.

## Affected

- `Linux >= a9020fde67a6eb77f8130feff633189f99264db1 < 9d56aced21fb9c104e8a3f3be9b21fbafe448ffc`
- `Linux >= a9020fde67a6eb77f8130feff633189f99264db1 < 42f0d3d81209654c08ffdde5a34b9b92d2645896`
- `Linux >= a9020fde67a6eb77f8130feff633189f99264db1 < bbe7bd722bfaea36aab3da6cc60fb4a05c644643`
- `Linux >= a9020fde67a6eb77f8130feff633189f99264db1 < 98b726ab5e2a4811e27c28e4d041f75bba147eab`
- `Linux >= a9020fde67a6eb77f8130feff633189f99264db1 < b8c56a3fc5d879c0928f207a756b0f067f06c6a8`
- `Linux >= a9020fde67a6eb77f8130feff633189f99264db1 < 6931d21f87bc6d657f145798fad0bf077b82486c`
- `Linux 4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.