CVE-2026-31695: 5-Year-Old Linux Kernel virt_wifi Use-After-Free Allows Unprivileged Local Root

Key facts for virt_wifi root exploit

Detection coverage for virt_wifi root exploit

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5131 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: modprobe_path Tampering via sysctl or /proc/sys/kernel/modprobe - CVE-2026-31695 Post-Exploitation

Detects commands that set kernel.modprobe or write to /proc/sys/kernel/modprobe. The public CVE-2026-31695 research (TL-2026-5131) describes overwriting modprobe_path to point at an attacker-controlled script and then triggering the kernel usermode helper by executing a file with an unknown binary format, yielding a root shell. The kernel-memory write itself is invisible to userland telemetry, but operators and secondary payloads who reproduce the technique through sysctl or tee leave a process-creation trail. Redirections performed by an interactive shell do not appear in an echo command line, so also review sh -c wrappers.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1548
• Data sources: sysmon_for_linux, mde_linux, linux:audit
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype=sysmon:linux EventCode=1 (CommandLine="*kernel.modprobe*" OR CommandLine="*/proc/sys/kernel/modprobe*")
```modprobe_path hijack used by the CVE-2026-31695 root payload```
| where match(CommandLine,"kernel\.modprobe\s*=|(>|tee\s).*/proc/sys/kernel/modprobe")
| table _time host User Image CommandLine ParentImage

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine matches regex @"kernel\.modprobe\s*=|(>|tee\s).*/proc/sys/kernel/modprobe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Kernel modprobe_path Modification via sysctl or procfs (CVE-2026-31695)
id: 8d3a9f14-6b27-4c0e-b5d8-1e7a4c92f302
status: experimental
description: Detects attempts to change the kernel usermode helper path kernel.modprobe through sysctl or by writing /proc/sys/kernel/modprobe, the modprobe_path overwrite technique described for the CVE-2026-31695 virt_wifi exploit chain.
references:
    - https://ptswarm.com/blog/dangerous-device-exploiting-cve-2026-31695-in-the-linux-kernel-via-struct-device/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-31695
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.t1548
    - cve.2026-31695
logsource:
    product: linux
    category: process_creation
detection:
    selection_sysctl:
        CommandLine|contains:
            - 'kernel.modprobe='
            - 'kernel.modprobe ='
    selection_redirect:
        CommandLine|contains|all:
            - '/proc/sys/kernel/modprobe'
            - '>'
    selection_tee:
        CommandLine|contains|all:
            - 'tee '
            - '/proc/sys/kernel/modprobe'
    condition: 1 of selection_*
falsepositives:
    - Hardening baselines that deliberately set kernel.modprobe to a fixed path or to an empty value
level: critical

Known false positives:

• CIS/STIG hardening scripts that set kernel.modprobe to a fixed value such as /bin/true or /sbin/modprobe
• Configuration management runs (Ansible, Puppet) applying sysctl baselines

Tuning notes: Allow-list the exact value your baseline sets (for example /sbin/modprobe) by adding a NOT clause on the assigned path, and exclude the configuration-management parent process. Any assignment to /tmp, /dev/shm, /var/tmp or a user home directory should be treated as confirmed compromise. Complement with the auditd execve rule on kernel-spawned shells (SIG-002), since the actual kernel memory overwrite is not visible to process telemetry.

• 🔒 Unprivileged User + Network Namespace Creation via unshare - CVE-2026-31695 Staging · unlock with TL Creds
• 🔒 SELinux Enforcement Disabled - CVE-2026-31695 Exploit Chain Defense Evasion · unlock with TL Creds
• 🔒 Audit Tampering and Log Clearing After Root Escalation - CVE-2026-31695 Post-Exploitation Cleanup · unlock with TL Creds
• 🔒 virt_wifi Kernel Module Load/Unload Activity - CVE-2026-31695 Exploitation · unlock with TL Creds
• 🔒 Kernel Usermode Helper Spawning a Root Shell or Interpreter - modprobe_path Hijack (CVE-2026-31695) · unlock with TL Creds
• 🔒 Kernel Version and virt_wifi / User-Namespace Reconnaissance - CVE-2026-31695 Target Selection · unlock with TL Creds
• 🔒 virt_wifi / veth Virtual Device Creation by Unprivileged User - CVE-2026-31695 Exploitation Setup · unlock with TL Creds
• 🔒 Kernel Oops / KASAN Splat Naming virt_wifi or ethtool-netlink Teardown Path - CVE-2026-31695 Exploit Attempts · unlock with TL Creds

Indicators of compromise for virt_wifi root exploit

As of 2026-11-03, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5131.

How virt_wifi root exploit works

CVE-2026-31695 is a use-after-free (CWE-416) in the Linux kernel's virt_wifi driver, present in the kernel source for approximately five years before discovery. The virt_wifi driver links each virtual wifi netdevice to its lower (parent) device using SET_NETDEV_DEV(dev, &priv->lowerdev->dev). During teardown, unregistration of the virt_wifi device in netdev_run_todo() can race with deallocation of the underlying lower device object referenced by that SET_NETDEV_DEV() call. If an ethtool operation (e.g. ETHTOOL_MSG_FEATURES_SET) is issued against the virt_wifi device while it is being unregistered, the kernel dereferences the now-dangling struct device pointer, producing a use-after-free condition in kernel memory.

Researcher Alexander Popov demonstrated that although the underlying bug presents as a narrow timing race, it can be made reliable enough for practical exploitation on a stock configuration by combining namespace-based privilege setup (unprivileged user/network namespaces), concurrent netlink/ethtool request flooding to widen the effective race window, and heap-grooming techniques to place attacker-influenced data at the freed location. Popov's published proof-of-concept targets a default Fedora 44 Server installation on x86_64 and achieves full local root from an unprivileged user context, without requiring any prior code execution privilege beyond standard unprivileged user namespace capabilities. The research additionally discusses techniques for inferring kernel addresses and routing execution through legitimate power-management callback pointers reachable from the spoofed device object, ultimately redirecting execution to attacker-chosen code paths that disable enforcement and gain root.

The flaw affects a broad span of stable and longterm Linux kernel branches that shipped the virt_wifi driver with the vulnerable SET_NETDEV_DEV() call. It was fixed by removing the SET_NETDEV_DEV() call from the driver's teardown/registration path, eliminating the dangling parent-device reference. Fixes landed across the 5.15, 6.1, 6.6, 6.12, 6.18 and 6.19 stable branches. CVSS scoring differs by vendor: Amazon Linux rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, High/Important), reflecting local-to-root escalation impact, while Red Hat rates it Low, reflecting that virt_wifi is not loaded by default on most Red Hat-derived distributions and local access is a precondition. No in-the-wild exploitation has been reported; the primary public source states no observed network IOCs, as this is a local kernel vulnerability rather than a remote or network-propagated threat.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Privilege Escalation

T1078 Valid Accounts; T1548 Abuse Elevation Control Mechanism

Discovery

T1082 System Information Discovery

Persistence

T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions

defense-impairment

T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall

Remediation for virt_wifi root exploit

Patches

• Upgrade to Linux kernel 5.15.203 or later
• Upgrade to Linux kernel 6.1.168 or later
• Upgrade to Linux kernel 6.6.134 or later
• Upgrade to Linux kernel 6.12.81 or later
• Upgrade to Linux kernel 6.18.22 or later
• Upgrade to Linux kernel 6.19.12 or later
• Apply Amazon Linux advisories ALAS2023-2026-1681 and ALAS2023-2026-1746

Immediate actions

• Blacklist the virt_wifi kernel module where it is not required: echo 'blacklist virt_wifi' > /etc/modprobe.d/disable-virt-wifi.conf and remove any loaded instance with rmmod virt_wifi
• Restrict unprivileged user namespace creation (e.g. set kernel.unprivileged_userns_clone=0 or use user_namespaces.enable=0 / userns restrictions) on systems where it is not needed, since the published exploit relies on unprivileged user and network namespaces
• Audit systems for unnecessary CONFIG_VIRT_WIFI module loading, especially container hosts and multi-tenant Linux servers where local attackers may already have unprivileged shell access

Workarounds

• Blacklist/unload the virt_wifi driver on systems that do not require it
• Restrict unprivileged user namespace and network namespace creation for untrusted local users

Longer-term hardening

• Apply kernel updates as part of regular patch management; track distribution-specific advisories (Amazon Linux ALAS2023-2026-1681, ALAS2023-2026-1746) for backport status
• Deploy kernel runtime integrity / LSM-based monitoring (e.g. SELinux enforcing mode, AppArmor) and verify enforcement state is not silently disabled on sensitive hosts
• Enable and tune kernel hardening features (CONFIG_RANDOM_KMALLOC_CACHES, CONFIG_SLAB_BUCKETS, KASLR) and track upstream guidance as researchers identify residual gaps exploited by this class of bug

Affected and fixed versions

• Linux Kernel Organization — Linux Kernel (virt_wifi driver)
  Vulnerable versions: 5.15.0 - 5.15.202; 5.16.0 - 6.1.167; 6.2.0 - 6.6.133; 6.7.0 - 6.12.80; 6.13.0 - 6.18.21; 6.19.0 - 6.19.11
  Fixed in: 5.15.203; 6.1.168; 6.6.134; 6.12.81; 6.18.22; 6.19.12
• Fedora Project — Fedora Server
  Vulnerable versions: Fedora 44 Server (default install, kernel 6.19.10-300.fc44 and earlier unpatched)
  Fixed in: Fedora kernel builds incorporating upstream fix for CVE-2026-31695
• Amazon Web Services — Amazon Linux 2023
  Vulnerable versions: Kernel versions predating ALAS2023-2026-1681 and ALAS2023-2026-1746
  Fixed in: Kernel versions per ALAS2023-2026-1681 and ALAS2023-2026-1746
• Red Hat — Red Hat Enterprise Linux (kernel)
  Vulnerable versions: RHEL kernel builds containing the vulnerable virt_wifi driver
  Fixed in: RHEL kernel builds incorporating the upstream SET_NETDEV_DEV removal fix

Timeline of virt_wifi root exploit

• 2021-01-01 Vulnerable SET_NETDEV_DEV() call introduced into the Linux kernel virt_wifi driver, approximately five years before public disclosure.
• 2026-01-01 Researcher locked-ioc-3 identifies the virt_wifi use-after-free race condition during kernel vulnerability research, reportedly aided by syzkaller fuzzing.
• 2026-05-01 CVE-2026-31695 is formally assigned and published in the CVE/NVD databases with CWE-416 (Use After Free) classification.
• 2026-07-15 CVE-2026-31695 record last modified in NVD, refining affected version ranges and references.
• 2026-10-28 CVE-2026-31695 OSV/CVE record further modified, consolidating fix commit references across stable branches.
• 2026-11-02 locked-ioc-3 publishes detailed technical writeup and working exploit ('Dangerous Device') demonstrating unprivileged local root on default Fedora 44 Server x86_64 via CVE-2026-31695.
• 2026-11-03 Threadlinqs threat hunt TL-2026-5131 created from GBHackers coverage to track CVE-2026-31695 and its public exploit.
• 2026-11-03 GBHackers publishes news coverage of the disclosed vulnerability and public exploit, summarizing CVSS scoring differences between Amazon Linux (7.8/High) and Red Hat (Low).

Sources cited for virt_wifi root exploit

• CVE-2026-31695 Record CVE Program · Advisory · 2026-05-01
• NVD - CVE-2026-31695 Detail NVD (NIST) · Advisory · 2026-05-01
• CVE-2026-31695 - OSV.dev osv.dev · Advisory · 2026-05-01
• Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device ptswarm.com · Research · 2026-11-02
• CVE-2026-31695 - SentinelOne Vulnerability Database SentinelOne · Vendor report · 2026-05-01
• CVE-2026-31695 - TuxCare CVE Tracker tuxcare.com · Vendor report · 2026-05-01
• Linux Stable Kernel Git Repository (fix commits) git.kernel.org · Code repository · 2026-05-01
• CVE-2026-31695 CVEProject/cvelistV5 JSON Record raw.githubusercontent.com · Code repository · 2026-05-01
• 5-Year-Old Linux Kernel Vulnerability Allows Unprivileged Attackers to Gain Root Access gbhackers.com · News · 2026-11-03

More in vulnerability

• Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets (LND macaroon credential exposure)
• Local Privilege Escalation via sudo iptables / iptables-save (Comment Newline Injection and --modprobe Abuse)
• Attackers Target Unpatched CryptoPayment Gateway WordPress Plugin Flaw (CVE-2026-81648) Exposing Wallet Credentials
• FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)
• PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)