You are using an out of date browser. It may not display this or other websites correctly. You should upgrade or use an alternative browser.
af_packet fanout
About this tag
The af_packet fanout tag covers discussions about the AF_PACKET socket family's fanout mechanism in the Linux kernel, particularly a race condition leading to a use-after-free vulnerability (CVE-2026-31504). This issue occurs during packet_release when a concurrent NETDEV_UP event re-registers a socket into a fanout group after teardown begins, leaving a dangling pointer. The fix involves zeroing po->num while holding bind_lock to close the race window. Content includes technical analysis of the vulnerability, kernel patch details, and references from NVD and Microsoft Security Response Center. This tag is relevant for Linux kernel developers, security researchers, and system administrators managing network stacks.
The Linux kernel’s networking stack has a new memory-safety problem on its hands, and this one sits in an especially sensitive place: AF_PACKET fanout teardown. CVE-2026-31504 describes a race in packet_release where a concurrent NETDEV_UP event can re-register a socket into a fanout group after...