wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
In the Linux kernel, the following vulnerability has been resolved: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit wg_netns_pre_exit() manually acquires rtnl_lock() inside the pernet .pre_exit callback. This causes a hung task when another thread holds rtnl_mutex - the cleanup_net workqueue (or the setup_net failure rollback path) blocks indefinitely in wg_netns_pre_exit() waiting to acquire the lock. Convert to .exit_rtnl, introduced in commit 7a60d91c690b ("net: Add ->exit_rtnl() hook to struct pernet_operations."), where the framework already holds RTNL and batches all callbacks under a single rtnl_lock()/rtnl_unlock() pair, eliminating the contention window. The rcu_assign_pointer(wg->creating_net, NULL) is safe to move from .pre_exit to .exit_rtnl (which runs after synchronize_rcu()) because all RCU readers of creating_net either use maybe_get_net() - which returns NULL for a dying namespace with zero refcount - or access net->user_ns which remains valid throughout the entire ops_undo_list sequence. [ Jason: added __net_exit and __read_mostly annotations that were missing. ]
CVE-2026-31579
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31579
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"lessThan": "707607db2193591b68c0e70f814133472c185b1e",
"versionType": "git"
},
{
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"lessThan": "9a9e69155b2091b8297afaf1533b8d68a3096841",
"versionType": "git"
},
{
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"lessThan": "1c52ef00e391144334f10995985c2f256d4be982",
"versionType": "git"
},
{
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"lessThan": "a1d0f6cbb962af29586e3e65a4bced1a5e39221f",
"versionType": "git"
},
{
"status": "affected",
"version": "900575aa33a3eaaef802b31de187a85c4a4b4bd0",
"lessThan": "60a25ef8dacb3566b1a8c4de00572a498e2a3bf9",
"versionType": "git"
},
{
"status": "affected",
"version": "363cc6efdbb54bb06cd5034a69b41aae974a736f",
"versionType": "git"
},
{
"status": "affected",
"version": "5.7.7",
"lessThan": "5.8",
"versionType": "semver"
}
],
"programFiles": [
"drivers/net/wireguard/device.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireguard/device.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31579
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46231 · Revision 1
- Added to Heist Feed
- Publisher date