5-Year-Old Linux Kernel Vulnerability Allows Unprivileged Attackers to Gain Root Access

A Linux kernel flaw that sat unnoticed for nearly five years can let an unprivileged local user take full root control of a system.

Tracked as CVE-2026-31695, the bug was found and fixed by researcher Alexander Popov. He has now published a working exploit against a default Fedora 44 Server install on x86_64. The full technique is documented in a PT SWARM research write-up.

Linux Kernel Vulnerability

The vulnerability is a logical error in Linux network device management that produces a use-after-free condition. It lives in the virt_wifi driver, which linked each virtual network device to the lower device beneath it with this call :

SET_NETDEV_DEV(dev, &priv->lowerdev->dev);

The upstream fix is titled “wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free”. The trouble starts during teardown. Unregistering a virt_wifi device in netdev_run_todo() can run at the same time as the lower device is freed. The virtual device’s dev. parent pointer then refers to freed memory. A later ethtool operation reaches ethnl_ops_begin(), which uses that dangling pointer :

pm_runtime_get_sync(dev->dev.parent);

NVD classifies the weakness as CWE-416, Use After Free. Long-lived kernel bugs like this one keep surfacing in rarely audited code. The ZcopyReaper vulnerability is a recent example. It affects the RDS zero-copy path and has existed since kernel 4.17.

On paper, the bug looks like a stability problem that depends on a tight race window. Popov’s research shows it is much more dangerous. He explains how he made the race stable enough for practical use. He also shows how a spoofed struct device lets an attacker get past the kernel’s security hardening and take full control of the operating system.

The impact is local privilege escalation (LPE). An attacker first needs a foothold, such as a low-privileged shell, a compromised service account, or code running in a shared environment. Once inside, the flaw becomes a direct route to root. That makes multi-user servers, CI runners, shared hosting and container hosts the highest-risk targets.

Attackers already pair kernel LPE bugs with other flaws. Recent intrusions chained PHP2Shell vulnerabilities with the Fragnesia kernel flaw to gain root on Palo Alto Networks PAN-OS systems. A bug like CVE-2026-31695 could fill the same role after an initial compromise.

Vendors disagree on how serious CVE-2026-31695 is. Amazon Linux rates it Important with a CVSS v3 score of 7.8 (AV:L/AC:L/PR:L/UI:N). Red Hat rates it Low.

The AppSecure database, listed before the new research, showed no known public exploit, an EPSS score of 0.01%, and no CISA KEV entry. Popov’s work changes that picture, because a root exploit now exists for a mainstream distribution. Defenders should not rely on the lower ratings.

Fixed Versions and Mitigation

NVD lists fixes in kernel 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22 and 6.19.12 . Amazon Linux 2023 users should apply ALAS2023-2026-1681 and ALAS2023-2026-1746, while Amazon Linux 2 is listed as not affected. Administrators should first check the running kernel and whether the vulnerable driver is present:

uname -r

lsmod | grep virt_wifi

Where virt_wifi isn’t needed, blocklisting it removes the vulnerable code path. This step is my suggestion, not an official vendor workaround:

echo "blacklist virt_wifi" | sudo tee /etc/modprobe.d/disable-virt-wifi.conf

sudo modprobe -r virt_wifi

The permanent fix is still the patched kernel or your distribution’s backport. Hosts that allow untrusted local code should be updated first. Teams should also watch for repeated creation and removal of virtual network devices and unusual ethtool activity, which could point to attempts to win the race.

Kernel hardening raises the cost of exploitation but cannot replace timely patching. The page cache attacks seen in DirtyClone show how often local users still find a path to root. Organizations should treat every public kernel LPE exploit as a prompt to review their patch cadence.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.