---
title: "CVE-2026-31678 — An Open vSwitch teardown race could reuse a freed port device"
description: "CVE-2026-31678: An Open vSwitch port could be detached once by device-unregister handling and then destroyed through another path. The second path cleared and released its device immediately, without waiting for packet readers that had already found the port. Fixed upstream in March 2026."
url: https://nebusec.ai/buglist/CVE-2026-31678/
published: 2026-09-02T00:00:00.000Z
---

CVE-2026-31678 · High

# An Open vSwitch teardown race could reuse a freed port device

Linux kernel · Open vSwitch · Published Sep 02, 2026

ovs_netdev_tunnel_destroy

* [CVSS 7.8 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-31678)
* Fixed
* Use-after-free
* Namespace required

Affects · Linux v4.3 until the fix · Fedora 44 · Linux 6.19.10-300 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

An Open vSwitch port could be detached once by device-unregister handling and then destroyed through another path. The second path cleared and released its device immediately, without waiting for packet readers that had already found the port.

The race dated to August 2015 and was fixed upstream in March 2026. The public exploit was validated on Fedora 44 with Linux 6.19.10-300.

## Why it mattered

A local attacker able to create the relevant virtual networking setup in a namespace could race port teardown against packet output. A packet reader could then dereference the released device, leading to a crash or exploitable kernel memory reuse.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`ovs_netdev_tunnel_destroy()` skipped `ovs_netdev_detach_dev()` when unregister handling had detached the port already. That also skipped its network-reader grace period before `netdev_put()` released the device.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-31678-Fedora-6.19.10-300)

Exploit entry point · 2296 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-31678-Fedora-6.19.10-300/exploit.c#L2169)

```c
int main(int argc, char **argv)
{
    int attempt;

    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);
    if (argc == 2 && !strcmp(argv[1], "--attempt")) {
        int rc = f29_attempt(F29_SUCCESS_FD);

        close(F29_SUCCESS_FD);
        fprintf(stderr, "F29_ATTEMPT_EXIT rc=%d method=_exit\n", rc);
        _exit(rc);
    }
    if (argc != 1) {
        fprintf(stderr, "F29_BATCH_REJECT reason=arguments\n");
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in March 2026.** The fix preserves the required grace period and device lifetime across both teardown paths. Fedora systems should run a kernel containing the March 2026 upstream correction.

The safest check is the distribution’s own kernel changelog for `CVE-2026-31678`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)