CVE-2026-31680

ip6fl_seq_show() reads the global IPv6 flowlabel hash while holding an RCU read lock and prints the length of an attached option if present. The flowlabel implementation frees the option object as soon as its user count drops to zero, but the surrounding flowlabel structure remains in the hash table until later garbage collection. A reader of /proc/net/ip6_flowlabel can therefore race the early kfree() and dereference freed memory, causing a kernel crash. This is a classic use‑after‑free leading to a denial of service. The flaw is identified as CWE‑825.

The issue exists in all Linux kernel releases prior to the merge of the commit that delays freeing the flowlabel option until the RCU teardown. The affected kernel versions are therefore all current running kernels that have not yet applied the patch, regardless of the specific release number. The CPE list confirms coverage of all Linux kernel product variants.

The CVSS score of 7.8 indicates high severity for a denial of service. The EPSS score of less than 1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector can be inferred to be local, requiring read access to /proc/net/ip6_flowlabel, which may be world-readable on some systems. An attacker can trigger the race by concurrently accessing that file, leading to a kernel panic or system reboot. The flaw is identified as CWE-416 and CWE-825.