Security readout for executives and security teams
Plain-English summary
A flaw in Linux's virtual Wi-Fi networking code can access memory after it has been freed while a virtual interface is being removed. A local, low-privileged user may be able to trigger memory corruption, potentially affecting confidentiality, integrity, and system availability. Exposure depends on the affected kernel code and virt_wifi usage.
Executive priority
Prioritize remediation on multi-user or otherwise locally accessible systems using virt_wifi. Schedule prompt kernel updates through normal change control. Systems without virt_wifi exposure are lower priority, but should still be checked because the supplied version data does not provide complete distribution-specific package mapping.
Technical view
virt_wifi assigned its network device parent to the lower device. Concurrent unregistration could free that parent while an ethtool operation called runtime power-management functions through the stale pointer, producing a slab use-after-free. The Linux fix removes the parent assignment. CVSS 3.1 is 7.8: local access, low privileges, no user interaction, and high potential impact.
Likely exposure
Likely exposure is limited to Linux systems running an affected kernel build where virt_wifi devices can be created or operated. The bundle lists affected release information spanning 5.15 through 7.0, but its version formatting is insufficient to determine every vulnerable range. Confirm exact status against distribution advisories and included stable commits.
Exploitation context
The supplied record does not identify public exploitation, and the CVE is not listed as KEV in the bundle. The demonstrated failure was detected by KASAN during ethtool activity concurrent with virt_wifi device unregistration. Treat exploitation as unconfirmed; the CVSS assessment nevertheless indicates potentially severe local impact.
Researcher notes
The race involves virt_wifi teardown and ethtool operations, leaving net_device.dev.parent referencing freed lower-device memory before ethnl_ops_begin invokes pm_runtime_get_sync. The cited fix removes SET_NETDEV_DEV from virt_wifi. The bundle notes a possibly complementary ethtool fix, but does not establish that it is required for remediation.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix or backport.
- Confirm the chosen kernel package includes the virt_wifi parent-pointer removal.
- Where operationally acceptable, restrict virt_wifi availability until patched.
- Review Linux distribution guidance for precise affected and fixed package versions.
Validation and detection
- Inventory kernel versions on systems that enable or use virt_wifi.
- Map installed packages to distribution advisories and the referenced stable commits.
- After updating, confirm the running kernel is the remediated build.
- Review kernel diagnostics for use-after-free reports involving virt_wifi, ethtool, or runtime power management.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31695 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e90f3e74e1ebc26c461a74be490d322716bcdcb4CVE reference, Linux
- https://git.kernel.org/stable/c/dcb5915696bd7b32b6404a897c24ee47cb23e772CVE reference, Linux
- https://git.kernel.org/stable/c/d1e3aa80e6e04410ba89eaaba4441a0d749d181dCVE reference, Linux
- https://git.kernel.org/stable/c/c5fa98842783ed227365d1303785de6a67020c8dCVE reference, Linux
- https://git.kernel.org/stable/c/5bbadf60b121065ffb267ec92018607b9c1c7524CVE reference, Linux
- https://git.kernel.org/stable/c/5adc01506da94dfaab76f3d1b8410a8ca7bfc59dCVE reference, Linux
- https://git.kernel.org/stable/c/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.