CVE-2026-31695

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free<br /> <br /> Currently we execute `SET_NETDEV_DEV(dev, &amp;priv-&gt;lowerdev-&gt;dev)` for<br /> the virt_wifi net devices. However, unregistering a virt_wifi device in<br /> netdev_run_todo() can happen together with the device referenced by<br /> SET_NETDEV_DEV().<br /> <br /> It can result in use-after-free during the ethtool operations performed<br /> on a virt_wifi device that is currently being unregistered. Such a net<br /> device can have the `dev.parent` field pointing to the freed memory,<br /> but ethnl_ops_begin() calls `pm_runtime_get_sync(dev-&gt;dev.parent)`.<br /> <br /> Let&amp;#39;s remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:<br /> <br /> ==================================================================<br /> BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0<br /> Read of size 2 at addr ffff88810cfc46f8 by task pm/606<br /> <br /> Call Trace:<br /> <br /> dump_stack_lvl+0x4d/0x70<br /> print_report+0x170/0x4f3<br /> ? __pfx__raw_spin_lock_irqsave+0x10/0x10<br /> kasan_report+0xda/0x110<br /> ? __pm_runtime_resume+0xe2/0xf0<br /> ? __pm_runtime_resume+0xe2/0xf0<br /> __pm_runtime_resume+0xe2/0xf0<br /> ethnl_ops_begin+0x49/0x270<br /> ethnl_set_features+0x23c/0xab0<br /> ? __pfx_ethnl_set_features+0x10/0x10<br /> ? kvm_sched_clock_read+0x11/0x20<br /> ? local_clock_noinstr+0xf/0xf0<br /> ? local_clock+0x10/0x30<br /> ? kasan_save_track+0x25/0x60<br /> ? __kasan_kmalloc+0x7f/0x90<br /> ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0<br /> genl_family_rcv_msg_doit+0x1e7/0x2c0<br /> ? __pfx_genl_family_rcv_msg_doit+0x10/0x10<br /> ? __pfx_cred_has_capability.isra.0+0x10/0x10<br /> ? stack_trace_save+0x8e/0xc0<br /> genl_rcv_msg+0x411/0x660<br /> ? __pfx_genl_rcv_msg+0x10/0x10<br /> ? __pfx_ethnl_set_features+0x10/0x10<br /> netlink_rcv_skb+0x121/0x380<br /> ? __pfx_genl_rcv_msg+0x10/0x10<br /> ? __pfx_netlink_rcv_skb+0x10/0x10<br /> ? __pfx_down_read+0x10/0x10<br /> genl_rcv+0x23/0x30<br /> netlink_unicast+0x60f/0x830<br /> ? __pfx_netlink_unicast+0x10/0x10<br /> ? __pfx___alloc_skb+0x10/0x10<br /> netlink_sendmsg+0x6ea/0xbc0<br /> ? __pfx_netlink_sendmsg+0x10/0x10<br /> ? __futex_queue+0x10b/0x1f0<br /> ____sys_sendmsg+0x7a2/0x950<br /> ? copy_msghdr_from_user+0x26b/0x430<br /> ? __pfx_____sys_sendmsg+0x10/0x10<br /> ? __pfx_copy_msghdr_from_user+0x10/0x10<br /> ___sys_sendmsg+0xf8/0x180<br /> ? __pfx____sys_sendmsg+0x10/0x10<br /> ? __pfx_futex_wait+0x10/0x10<br /> ? fdget+0x2e4/0x4a0<br /> __sys_sendmsg+0x11f/0x1c0<br /> ? __pfx___sys_sendmsg+0x10/0x10<br /> do_syscall_64+0xe2/0x570<br /> ? exc_page_fault+0x66/0xb0<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> <br /> This fix may be combined with another one in the ethtool subsystem:<br /> https://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u