CVE-2026-31680High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file RCU read-side lock and print…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
ip6fl_seq_show() walks the global flowlabel hash under the seq-file
RCU read-side lock and prints fl->opt->opt_nflen when an option block
is present.
Exclusive flowlabels currently free fl->opt as soon as fl->users
drops to zero in fl_release(). However, the surrounding
struct ip6_flowlabel remains visible in the global hash table until
later garbage collection removes it and fl_free_rcu() finally tears it
down.
A concurrent /proc/net/ip6_flowlabel reader can therefore race that
early kfree() and dereference freed option state, triggering a crash
in ip6fl_seq_show().
Fix this by keeping fl->opt alive until fl_free_rcu(). That matches
the lifetime already required for the enclosing flowlabel while readers
can still reach it under RCU.
Linux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 4b6798024f7b2d535f3db1002c760143cdbd1bd3Linux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 3c54b66c83fb8fcbde8e6a7bf90b65856e39f827Linux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 5a6b15f861b7c1304949e3350d23490a5fe429fdLinux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 6c7fbdb8ffde6413640de7cfbd7c976c353e89f8Linux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 8027964931785cb73d520ac70a342a3dc16c249bLinux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 414726b69921fe6355ae453f5b35e68dd078342aLinux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 572ce62778519a7d4d1c15f55dd2e45a474133c4Linux >= d3aedd5ebd4b0b925b0bcda548066803e1318499 < 9ca562bb8e66978b53028fa32b1a190708e6a091Linux 3.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90068NoneIn the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal t…
CVE-2026-90090NoneIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdio_tx_packet() rounds the transfer size up to the SDIO block size of 256 bytes, but hands the ho…
CVE-2026-90093High· 7.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Since commit b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") l2cap_chan:…
CVE-2026-90098NoneIn the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates dev->mc via __dev_mc_sync(), which per…
CVE-2026-90121NoneIn the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initializa…
CVE-2026-90156NoneIn the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registerin…