CVE-2026-31680 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux kernel versions 3.9 through 7.0-rc6 should be aware of this vulnerability and take steps to mitigate it. Affected parties should review and apply patches from Linux kernel maintainers, update Linux kernel to a version that includes the fix, and monitor for suspicious activity related to IPv6 flowlabel handling.

Technical summary

The Linux kernel's IPv6 flowlabel handling has a use-after-free vulnerability. The `ip6fl_seq_show()` function walks the global flowlabel hash under the seq-file RCU read-side lock and prints `fl->opt->opt_nflen` when an option block is present. However, exclusive flowlabels currently free `fl->opt` as soon as `fl->users` drops to zero in `fl_release()`. This can cause a concurrent `/proc/net/ip6_flowlabel` reader to dereference freed option state, triggering a crash. The fix defers the free of `fl->opt` until `fl_free_rcu()`, matching the lifetime already required for the enclosing flowlabel.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel maintainers
• Update Linux kernel to a version that includes the fix
• Monitor for suspicious activity related to IPv6 flowlabel handling
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-25T09:16:01.673Z and last modified on 2026-07-14T13:18:48.493Z. The NVD entry is currently Modified. This information is based on the provided source corpus and may not reflect the most current or accurate details. Further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.