CVE-2026-31502 Linux CVE debrief

Who should care

Users of Linux kernel versions 3.7.1 to 6.12.80, 6.13 to 6.18.21, and 6.19 to 6.19.11 should be aware of this vulnerability and take necessary actions to mitigate it. Operators, platform administrators, vulnerability management teams, and security teams should review the affected scope and severity to determine the impact on their deployments.

Technical summary

The vulnerability is caused by the team module's incorrect handling of header_ops for non-Ethernet ports. When the team device calls dev_hard_header() or dev_parse_header(), it can lead to a type confusion crash. The fix introduces team header_ops wrappers for create/parse, selecting a team port under RCU, and calling the lower device callbacks with port->dev. This ensures that each callback always sees the correct net_device context. The selected lower device is also passed to the lower parse callback, bounding recursion in stacked non-Ethernet topologies and ensuring parse callbacks run with the correct device context.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel stable branches
• Update Linux kernel to version 6.12.81 or later
• Use Linux kernel version 6.19.12 or later
• Use Linux kernel version 7.0-rc8 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by syzbot and fixed by introducing team header_ops wrappers. The affected versions of the Linux kernel are 3.7.1 to 6.12.80, 6.13 to 6.18.21, and 6.19 to 6.19.11. To verify, defenders should review the Linux kernel version and check for patches from Linux kernel stable branches. Evidence limits suggest that multiple vendors and users may be impacted, but specific details are still being verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.