wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (Linux Linux)

CVE-2026-31579
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.15 % · percentile 5 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit wg_netns_pre_exit() manually acquires rtnl_lock() inside the pernet .pre_exit callback. This causes a hung task when another thread holds rtnl_mutex - the cleanup_net workqueue (or the setup_net failure rollback path) blocks indefinitely in wg_netns_pre_exit() waiting to acquire the lock. Convert to .exit_rtnl, introduced in commit 7a60d91c690b ("net: Add ->exit_rtnl() hook to struct pernet_operations."), where the framework already holds RTNL and batches all callbacks under a single rtnl_lock()/rtnl_unlock() pair, eliminating the contention window. The rcu_assign_pointer(wg->creating_net, NULL) is safe to move from .pre_exit to .exit_rtnl (which runs after synchronize_rcu()) because all RCU readers of creating_net either use maybe_get_net() - which returns NULL for a dying namespace with zero refcount - or access net->user_ns which remains valid throughout the entire ops_undo_list sequence. [ Jason: added __net_exit and __read_mostly annotations that were missing. ]

Weaknesses (CWE)

  • CWE-476 — NULL Pointer Dereference

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 707607db2193591b68c0e70f814133472c185b1e ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 9a9e69155b2091b8297afaf1533b8d68a3096841 ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 1c52ef00e391144334f10995985c2f256d4be982 ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < a1d0f6cbb962af29586e3e65a4bced1a5e39221f ; affected 900575aa33a3eaaef802b31de187a85c4a4b4bd0 < 60a25ef8dacb3566b1a8c4de00572a498e2a3bf9 ; affected 363cc6efdbb54bb06cd5034a69b41aae974a736f
Linux · Linuxaffected 5.8 ; unaffected 0 < 5.8 ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.24 ≤ 6.18.* ; unaffected 6.19.14 ≤ 6.19.* ; unaffected 7.0.1 ≤ 7.0.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD