GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31695 (GCVE-0-2026-31695)

Vulnerability from cvelistv5 – Published: 2026-05-01 13:53 – Updated: 2026-08-05 12:24
VLAI
Title
wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for the virt_wifi net devices. However, unregistering a virt_wifi device in netdev_run_todo() can happen together with the device referenced by SET_NETDEV_DEV(). It can result in use-after-free during the ethtool operations performed on a virt_wifi device that is currently being unregistered. Such a net device can have the `dev.parent` field pointing to the freed memory, but ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`. Let's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this: ================================================================== BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0 Read of size 2 at addr ffff88810cfc46f8 by task pm/606 Call Trace: <TASK> dump_stack_lvl+0x4d/0x70 print_report+0x170/0x4f3 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kasan_report+0xda/0x110 ? __pm_runtime_resume+0xe2/0xf0 ? __pm_runtime_resume+0xe2/0xf0 __pm_runtime_resume+0xe2/0xf0 ethnl_ops_begin+0x49/0x270 ethnl_set_features+0x23c/0xab0 ? __pfx_ethnl_set_features+0x10/0x10 ? kvm_sched_clock_read+0x11/0x20 ? local_clock_noinstr+0xf/0xf0 ? local_clock+0x10/0x30 ? kasan_save_track+0x25/0x60 ? __kasan_kmalloc+0x7f/0x90 ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0 genl_family_rcv_msg_doit+0x1e7/0x2c0 ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 ? __pfx_cred_has_capability.isra.0+0x10/0x10 ? stack_trace_save+0x8e/0xc0 genl_rcv_msg+0x411/0x660 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_ethnl_set_features+0x10/0x10 netlink_rcv_skb+0x121/0x380 ? __pfx_genl_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_down_read+0x10/0x10 genl_rcv+0x23/0x30 netlink_unicast+0x60f/0x830 ? __pfx_netlink_unicast+0x10/0x10 ? __pfx___alloc_skb+0x10/0x10 netlink_sendmsg+0x6ea/0xbc0 ? __pfx_netlink_sendmsg+0x10/0x10 ? __futex_queue+0x10b/0x1f0 ____sys_sendmsg+0x7a2/0x950 ? copy_msghdr_from_user+0x26b/0x430 ? __pfx_____sys_sendmsg+0x10/0x10 ? __pfx_copy_msghdr_from_user+0x10/0x10 ___sys_sendmsg+0xf8/0x180 ? __pfx____sys_sendmsg+0x10/0x10 ? __pfx_futex_wait+0x10/0x10 ? fdget+0x2e4/0x4a0 __sys_sendmsg+0x11f/0x1c0 ? __pfx___sys_sendmsg+0x10/0x10 do_syscall_64+0xe2/0x570 ? exc_page_fault+0x66/0xb0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> This fix may be combined with another one in the ethtool subsystem: https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d43c65b05b848e0b2db1a6c78b02c189da3a95b5 , < e90f3e74e1ebc26c461a74be490d322716bcdcb4 (git)
Affected: d43c65b05b848e0b2db1a6c78b02c189da3a95b5 , < dcb5915696bd7b32b6404a897c24ee47cb23e772 (git)
Affected: d43c65b05b848e0b2db1a6c78b02c189da3a95b5 , < d1e3aa80e6e04410ba89eaaba4441a0d749d181d (git)
Affected: d43c65b05b848e0b2db1a6c78b02c189da3a95b5 , < c5fa98842783ed227365d1303785de6a67020c8d (git)
Affected: d43c65b05b848e0b2db1a6c78b02c189da3a95b5 , < 5bbadf60b121065ffb267ec92018607b9c1c7524 (git)
Affected: d43c65b05b848e0b2db1a6c78b02c189da3a95b5 , < 5adc01506da94dfaab76f3d1b8410a8ca7bfc59d (git)
Affected: d43c65b05b848e0b2db1a6c78b02c189da3a95b5 , < 789b06f9f39cdc7e895bdab2c034e39c41c8f8d6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.134 , ≤ 6.6.* (semver)
Unaffected: 6.12.81 , ≤ 6.12.* (semver)
Unaffected: 6.18.22 , ≤ 6.18.* (semver)
Unaffected: 6.19.12 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/virtual/virt_wifi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e90f3e74e1ebc26c461a74be490d322716bcdcb4",
              "status": "affected",
              "version": "d43c65b05b848e0b2db1a6c78b02c189da3a95b5",
              "versionType": "git"
            },
            {
              "lessThan": "dcb5915696bd7b32b6404a897c24ee47cb23e772",
              "status": "affected",
              "version": "d43c65b05b848e0b2db1a6c78b02c189da3a95b5",
              "versionType": "git"
            },
            {
              "lessThan": "d1e3aa80e6e04410ba89eaaba4441a0d749d181d",
              "status": "affected",
              "version": "d43c65b05b848e0b2db1a6c78b02c189da3a95b5",
              "versionType": "git"
            },
            {
              "lessThan": "c5fa98842783ed227365d1303785de6a67020c8d",
              "status": "affected",
              "version": "d43c65b05b848e0b2db1a6c78b02c189da3a95b5",
              "versionType": "git"
            },
            {
              "lessThan": "5bbadf60b121065ffb267ec92018607b9c1c7524",
              "status": "affected",
              "version": "d43c65b05b848e0b2db1a6c78b02c189da3a95b5",
              "versionType": "git"
            },
            {
              "lessThan": "5adc01506da94dfaab76f3d1b8410a8ca7bfc59d",
              "status": "affected",
              "version": "d43c65b05b848e0b2db1a6c78b02c189da3a95b5",
              "versionType": "git"
            },
            {
              "lessThan": "789b06f9f39cdc7e895bdab2c034e39c41c8f8d6",
              "status": "affected",
              "version": "d43c65b05b848e0b2db1a6c78b02c189da3a95b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/virtual/virt_wifi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free\n\nCurrently we execute `SET_NETDEV_DEV(dev, \u0026priv-\u003elowerdev-\u003edev)` for\nthe virt_wifi net devices. However, unregistering a virt_wifi device in\nnetdev_run_todo() can happen together with the device referenced by\nSET_NETDEV_DEV().\n\nIt can result in use-after-free during the ethtool operations performed\non a virt_wifi device that is currently being unregistered. Such a net\ndevice can have the `dev.parent` field pointing to the freed memory,\nbut ethnl_ops_begin() calls `pm_runtime_get_sync(dev-\u003edev.parent)`.\n\nLet\u0027s remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0\n Read of size 2 at addr ffff88810cfc46f8 by task pm/606\n\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x4d/0x70\n  print_report+0x170/0x4f3\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  kasan_report+0xda/0x110\n  ? __pm_runtime_resume+0xe2/0xf0\n  ? __pm_runtime_resume+0xe2/0xf0\n  __pm_runtime_resume+0xe2/0xf0\n  ethnl_ops_begin+0x49/0x270\n  ethnl_set_features+0x23c/0xab0\n  ? __pfx_ethnl_set_features+0x10/0x10\n  ? kvm_sched_clock_read+0x11/0x20\n  ? local_clock_noinstr+0xf/0xf0\n  ? local_clock+0x10/0x30\n  ? kasan_save_track+0x25/0x60\n  ? __kasan_kmalloc+0x7f/0x90\n  ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0\n  genl_family_rcv_msg_doit+0x1e7/0x2c0\n  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10\n  ? __pfx_cred_has_capability.isra.0+0x10/0x10\n  ? stack_trace_save+0x8e/0xc0\n  genl_rcv_msg+0x411/0x660\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_ethnl_set_features+0x10/0x10\n  netlink_rcv_skb+0x121/0x380\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_netlink_rcv_skb+0x10/0x10\n  ? __pfx_down_read+0x10/0x10\n  genl_rcv+0x23/0x30\n  netlink_unicast+0x60f/0x830\n  ? __pfx_netlink_unicast+0x10/0x10\n  ? __pfx___alloc_skb+0x10/0x10\n  netlink_sendmsg+0x6ea/0xbc0\n  ? __pfx_netlink_sendmsg+0x10/0x10\n  ? __futex_queue+0x10b/0x1f0\n  ____sys_sendmsg+0x7a2/0x950\n  ? copy_msghdr_from_user+0x26b/0x430\n  ? __pfx_____sys_sendmsg+0x10/0x10\n  ? __pfx_copy_msghdr_from_user+0x10/0x10\n  ___sys_sendmsg+0xf8/0x180\n  ? __pfx____sys_sendmsg+0x10/0x10\n  ? __pfx_futex_wait+0x10/0x10\n  ? fdget+0x2e4/0x4a0\n  __sys_sendmsg+0x11f/0x1c0\n  ? __pfx___sys_sendmsg+0x10/0x10\n  do_syscall_64+0xe2/0x570\n  ? exc_page_fault+0x66/0xb0\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  \u003c/TASK\u003e\n\nThis fix may be combined with another one in the ethtool subsystem:\nhttps://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local rtnetlink/generic-netlink ethtool operations on a virt_wifi netdev, not by received WiFi or network frames.\nAC:L - The attacker can control both sides of the race by issuing ethtool operations while concurrently unregistering the lower/virt_wifi devices. No external victim timing or rare condition is required.\nPR:L - The path requires CAP_NET_ADMIN, but the relevant rtnetlink and ethtool checks are namespace-capable and can be reached by an unprivileged local user in a user/network namespace.\nUI:N - No victim action is required once the attacker has local access and can send the netlink requests.\nS:U - This is standard kernel memory corruption within the same host kernel security authority, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a use-after-free of the netdev parent device through pm_runtime_get_sync, and UAF memory corruption is defensibly capable of exposing kernel memory.\nI:H - The runtime PM path can operate on freed/reused memory, including atomic and lock/state updates, making kernel memory corruption and write/control-flow exploitation plausible.\nA:H - The reported failure is a KASAN slab-use-after-free in __pm_runtime_resume and can crash/oops the kernel, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:33.507Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e90f3e74e1ebc26c461a74be490d322716bcdcb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcb5915696bd7b32b6404a897c24ee47cb23e772"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1e3aa80e6e04410ba89eaaba4441a0d749d181d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5fa98842783ed227365d1303785de6a67020c8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bbadf60b121065ffb267ec92018607b9c1c7524"
        },
        {
          "url": "https://git.kernel.org/stable/c/5adc01506da94dfaab76f3d1b8410a8ca7bfc59d"
        },
        {
          "url": "https://git.kernel.org/stable/c/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6"
        }
      ],
      "title": "wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31695",
    "datePublished": "2026-05-01T13:53:36.857Z",
    "dateReserved": "2026-03-09T15:48:24.131Z",
    "dateUpdated": "2026-08-05T12:24:33.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31695",
      "date": "2026-09-02",
      "epss": "0.00126",
      "percentile": "0.02523"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31695\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T14:16:19.250\",\"lastModified\":\"2026-06-17T10:34:15.380\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free\\n\\nCurrently we execute `SET_NETDEV_DEV(dev, \u0026priv-\u003elowerdev-\u003edev)` for\\nthe virt_wifi net devices. However, unregistering a virt_wifi device in\\nnetdev_run_todo() can happen together with the device referenced by\\nSET_NETDEV_DEV().\\n\\nIt can result in use-after-free during the ethtool operations performed\\non a virt_wifi device that is currently being unregistered. Such a net\\ndevice can have the `dev.parent` field pointing to the freed memory,\\nbut ethnl_ops_begin() calls `pm_runtime_get_sync(dev-\u003edev.parent)`.\\n\\nLet\u0027s remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:\\n\\n ==================================================================\\n BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0\\n Read of size 2 at addr ffff88810cfc46f8 by task pm/606\\n\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x4d/0x70\\n  print_report+0x170/0x4f3\\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  kasan_report+0xda/0x110\\n  ? __pm_runtime_resume+0xe2/0xf0\\n  ? __pm_runtime_resume+0xe2/0xf0\\n  __pm_runtime_resume+0xe2/0xf0\\n  ethnl_ops_begin+0x49/0x270\\n  ethnl_set_features+0x23c/0xab0\\n  ? __pfx_ethnl_set_features+0x10/0x10\\n  ? kvm_sched_clock_read+0x11/0x20\\n  ? local_clock_noinstr+0xf/0xf0\\n  ? local_clock+0x10/0x30\\n  ? kasan_save_track+0x25/0x60\\n  ? __kasan_kmalloc+0x7f/0x90\\n  ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0\\n  genl_family_rcv_msg_doit+0x1e7/0x2c0\\n  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10\\n  ? __pfx_cred_has_capability.isra.0+0x10/0x10\\n  ? stack_trace_save+0x8e/0xc0\\n  genl_rcv_msg+0x411/0x660\\n  ? __pfx_genl_rcv_msg+0x10/0x10\\n  ? __pfx_ethnl_set_features+0x10/0x10\\n  netlink_rcv_skb+0x121/0x380\\n  ? __pfx_genl_rcv_msg+0x10/0x10\\n  ? __pfx_netlink_rcv_skb+0x10/0x10\\n  ? __pfx_down_read+0x10/0x10\\n  genl_rcv+0x23/0x30\\n  netlink_unicast+0x60f/0x830\\n  ? __pfx_netlink_unicast+0x10/0x10\\n  ? __pfx___alloc_skb+0x10/0x10\\n  netlink_sendmsg+0x6ea/0xbc0\\n  ? __pfx_netlink_sendmsg+0x10/0x10\\n  ? __futex_queue+0x10b/0x1f0\\n  ____sys_sendmsg+0x7a2/0x950\\n  ? copy_msghdr_from_user+0x26b/0x430\\n  ? __pfx_____sys_sendmsg+0x10/0x10\\n  ? __pfx_copy_msghdr_from_user+0x10/0x10\\n  ___sys_sendmsg+0xf8/0x180\\n  ? __pfx____sys_sendmsg+0x10/0x10\\n  ? __pfx_futex_wait+0x10/0x10\\n  ? fdget+0x2e4/0x4a0\\n  __sys_sendmsg+0x11f/0x1c0\\n  ? __pfx___sys_sendmsg+0x10/0x10\\n  do_syscall_64+0xe2/0x570\\n  ? exc_page_fault+0x66/0xb0\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  \u003c/TASK\u003e\\n\\nThis fix may be combined with another one in the ethtool subsystem:\\nhttps://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/virtual/virt_wifi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d43c65b05b848e0b2db1a6c78b02c189da3a95b5\",\"lessThan\":\"e90f3e74e1ebc26c461a74be490d322716bcdcb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d43c65b05b848e0b2db1a6c78b02c189da3a95b5\",\"lessThan\":\"dcb5915696bd7b32b6404a897c24ee47cb23e772\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d43c65b05b848e0b2db1a6c78b02c189da3a95b5\",\"lessThan\":\"d1e3aa80e6e04410ba89eaaba4441a0d749d181d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d43c65b05b848e0b2db1a6c78b02c189da3a95b5\",\"lessThan\":\"c5fa98842783ed227365d1303785de6a67020c8d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d43c65b05b848e0b2db1a6c78b02c189da3a95b5\",\"lessThan\":\"5bbadf60b121065ffb267ec92018607b9c1c7524\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d43c65b05b848e0b2db1a6c78b02c189da3a95b5\",\"lessThan\":\"5adc01506da94dfaab76f3d1b8410a8ca7bfc59d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d43c65b05b848e0b2db1a6c78b02c189da3a95b5\",\"lessThan\":\"789b06f9f39cdc7e895bdab2c034e39c41c8f8d6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/virtual/virt_wifi.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.168\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.134\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.81\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.22\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.12\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"85C0DA29-FD98-4182-B0A1-624E28976709\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.168\",\"matchCriteriaId\":\"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.134\",\"matchCriteriaId\":\"F56F925B-BAF8-4F4B-B62F-1496AF19A307\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.81\",\"matchCriteriaId\":\"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.22\",\"matchCriteriaId\":\"C9DF8BCE-36D3-475D-9D21-19E4F02F9029\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.12\",\"matchCriteriaId\":\"0A2B9540-02D5-41B4-B16A-82AF66FD4F36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5adc01506da94dfaab76f3d1b8410a8ca7bfc59d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5bbadf60b121065ffb267ec92018607b9c1c7524\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5fa98842783ed227365d1303785de6a67020c8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1e3aa80e6e04410ba89eaaba4441a0d749d181d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcb5915696bd7b32b6404a897c24ee47cb23e772\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e90f3e74e1ebc26c461a74be490d322716bcdcb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:27:22+00:00",
      "cve": "CVE-2026-31695",
      "id": "CVE-2026-31695",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31695.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:23:43Z",
      "cve": "CVE-2026-31695",
      "id": "CVE-2026-31695",
      "initial_release_date": "2026-05-02T01:25:40Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31695",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31695.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.