Security readout for executives and security teams
Plain-English summary
A Linux Open vSwitch flaw can mishandle a network-device reference while tunnel interfaces are being removed. A concurrent local process may encounter invalid kernel state, potentially compromising confidentiality, integrity, or availability. The supplied CVSS score is 7.8, making this a high-severity issue, but exposure depends on affected kernels and Open vSwitch tunnel use.
Executive priority
Prioritize affected virtualization, container, and networking hosts where Open vSwitch tunnels and untrusted local workloads coexist. Treat remediation as high priority, while validating actual exposure before emergency disruption. There is no supplied evidence of active exploitation, so urgency should be driven by host criticality and local-access risk.
Technical view
A race exists between ovs_netdev_tunnel_destroy() and concurrent readers of vport->dev after NETDEV_UNREGISTER detaches the device. Releasing the reference during tunnel destruction can violate its required lifetime. The stable fix defers netdev_put to the vport_netdev_free() RCU callback, aligning tunnel cleanup with the non-tunnel path.
Likely exposure
Likely exposure is limited to Linux systems running affected kernel builds with Open vSwitch tunnel vports. The CVSS vector indicates exploitation requires local access and low privileges, without user interaction. The supplied version list is ambiguous and does not reliably identify every vulnerable or fixed distribution package.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The reported impact is high across confidentiality, integrity, and availability, but practical exploitability and trigger conditions are not fully documented in the supplied sources.
Researcher notes
This is a reference-lifetime race involving tunnel vport teardown and RCU readers. The correction moves reference release into the RCU callback rather than adding synchronization under RTNL. The bundle supplies six stable-tree commits, but no CWE, reproducer, exploit details, or dependable mapping between listed versions and individual fixes.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable upstream stable fix, then reboot into it.
- Confirm the distribution package includes a backport of one of the cited stable commits.
- Consult the Linux distribution's guidance because the supplied sources name no standalone workaround.
- Restrict low-privilege local access to exposed hosts while remediation is pending.
Validation and detection
- Inventory kernel versions on hosts using Open vSwitch tunnel interfaces.
- Map distribution kernel builds to the cited stable commits or vendor backport documentation.
- Verify the patched kernel is active after reboot, not merely installed.
- Reassess local account and workload access on any host awaiting remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31678 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffcCVE reference, Linux
- https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896CVE reference, Linux
- https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643CVE reference, Linux
- https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eabCVE reference, Linux
- https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8CVE reference, Linux
- https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.