wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
CVE-2026-31579 is fixed in 19 products on 1 platform, first by ALAS2023-2026-1693, released May 8, 2026. It is not reported as exploited. Patch Radar priority: Routine.
In the Linux kernel, the following vulnerability has been resolved: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit wg_netns_pre_exit() manually acquires rtnl_lock() inside the pernet .pre_exit callback. This causes a hung task when another thread holds rtnl_mutex - the cleanup_net workqueue (or the setup_net failure rollback path) blocks indefinitely in wg_netns_pre_exit() waiting to acquire the lock. Convert to .exit_rtnl, introduced in commit 7a60d91c690b ("net: Add ->exit_rtnl() hook to struct pernet_operations."), where the framework already holds RTNL and batches all callbacks under a single rtnl_lock()/rtnl_unlock() pair, eliminating the contention window. The rcu_assign_pointer(wg->creating_net, NULL) is safe to move from .pre_exit to .exit_rtnl (which runs after synchronize_rcu()) because all RCU readers of creating_net either use maybe_get_net() - which returns NULL for a dying namespace with zero refcount - or access net->user_ns which remains valid throughout the entire ops_undo_list sequence. [ Jason: added __net_exit and __read_mostly annotations that were missing. ]
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bpftool6.18 · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| bpftool6.18-debuginfo · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel-livepatch-6.18.25-55.108 · amzn 2023 | 1:1.0-0.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18 · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-debuginfo · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-debuginfo-common-aarch64 · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-debuginfo-common-x86_64 · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-devel · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-headers · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-modules-extra · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-modules-extra-common · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-tools · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-tools-debuginfo · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| kernel6.18-tools-devel · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| linux · Debian 13.5 (trixie) | 6.12.115-2 | DEBIAN-CVE-2026-31579 | May 15, 2026 |
| linux · Debian 14 | 6.19.14-1 | DEBIAN-CVE-2026-31579 | May 15, 2026 |
| perf6.18 · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| perf6.18-debuginfo · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| python3-perf6.18 · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
| python3-perf6.18-debuginfo · amzn 2023 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 | May 8, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.