# CVE-2026-31695: 5-Year-Old Linux Kernel virt_wifi Use-After-Free Allows Unprivileged Local Root

> A five-year-old use-after-free vulnerability in the Linux kernel's virt_wifi driver (CVE-2026-31695, CVSS 7.8) allows an unprivileged local user to escalate to root. Researcher Alexander Popov discovered the race condition and published a working local-privilege-escalation exploit against a default Fedora 44 Server install on x86_64.

- **Published:** 2026-11-03T07:38:00Z
- **Last reviewed:** 2026-11-03T07:38:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5131
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5131.png
- **ID:** TL-2026-5131
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-31695

## Description

CVE-2026-31695 is a use-after-free (CWE-416) in the Linux kernel's virt_wifi driver, present in the kernel source for approximately five years before discovery. The virt_wifi driver links each virtual wifi netdevice to its lower (parent) device using SET_NETDEV_DEV(dev, &priv->lowerdev->dev). During teardown, unregistration of the virt_wifi device in netdev_run_todo() can race with deallocation of the underlying lower device object referenced by that SET_NETDEV_DEV() call. If an ethtool operation (e.g. ETHTOOL_MSG_FEATURES_SET) is issued against the virt_wifi device while it is being unregistered, the kernel dereferences the now-dangling struct device pointer, producing a use-after-free condition in kernel memory.

Researcher Alexander Popov demonstrated that although the underlying bug presents as a narrow timing race, it can be made reliable enough for practical exploitation on a stock configuration by combining namespace-based privilege setup (unprivileged user/network namespaces), concurrent netlink/ethtool request flooding to widen the effective race window, and heap-grooming techniques to place attacker-influenced data at the freed location. Popov's published proof-of-concept targets a default Fedora 44 Server installation on x86_64 and achieves full local root from an unprivileged user context, without requiring any prior code execution privilege beyond standard unprivileged user namespace capabilities. The research additionally discusses techniques for inferring kernel addresses and routing execution through legitimate power-management callback pointers reachable from the spoofed device object, ultimately redirecting execution to attacker-chosen code paths that disable enforcement and gain root.

The flaw affects a broad span of stable and longterm Linux kernel branches that shipped the virt_wifi driver with the vulnerable SET_NETDEV_DEV() call. It was fixed by removing the SET_NETDEV_DEV() call from the driver's teardown/registration path, eliminating the dangling parent-device reference. Fixes landed across the 5.15, 6.1, 6.6, 6.12, 6.18 and 6.19 stable branches. CVSS scoring differs by vendor: Amazon Linux rates it 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, High/Important), reflecting local-to-root escalation impact, while Red Hat rates it Low, reflecting that virt_wifi is not loaded by default on most Red Hat-derived distributions and local access is a precondition. No in-the-wild exploitation has been reported; the primary public source states no observed network IOCs, as this is a local kernel vulnerability rather than a remote or network-propagated threat.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1082 System Information Discovery
- T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1548 Abuse Elevation Control Mechanism

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**modprobe_path Tampering via sysctl or /proc/sys/kernel/modprobe - CVE-2026-31695 Post-Exploitation** (`TL-2026-5131-SPL-002`)

Detects commands that set kernel.modprobe or write to /proc/sys/kernel/modprobe. The public CVE-2026-31695 research (TL-2026-5131) describes overwriting modprobe_path to point at an attacker-controlled script and then triggering the kernel usermode helper by executing a file with an unknown binary format, yielding a root shell. The kernel-memory write itself is invisible to userland telemetry, but operators and secondary payloads who reproduce the technique through sysctl or tee leave a process-creation trail. Redirections performed by an interactive shell do not appear in an echo command line, so also review sh -c wrappers.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1548
- **Data sources:** sysmon_for_linux, mde_linux, linux:audit
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=linux sourcetype=sysmon:linux EventCode=1 (CommandLine="*kernel.modprobe*" OR CommandLine="*/proc/sys/kernel/modprobe*")
```modprobe_path hijack used by the CVE-2026-31695 root payload```
| where match(CommandLine,"kernel\.modprobe\s*=|(>|tee\s).*/proc/sys/kernel/modprobe")
| table _time host User Image CommandLine ParentImage
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine matches regex @"kernel\.modprobe\s*=|(>|tee\s).*/proc/sys/kernel/modprobe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Kernel modprobe_path Modification via sysctl or procfs (CVE-2026-31695)
id: 8d3a9f14-6b27-4c0e-b5d8-1e7a4c92f302
status: experimental
description: Detects attempts to change the kernel usermode helper path kernel.modprobe through sysctl or by writing /proc/sys/kernel/modprobe, the modprobe_path overwrite technique described for the CVE-2026-31695 virt_wifi exploit chain.
references:
    - https://ptswarm.com/blog/dangerous-device-exploiting-cve-2026-31695-in-the-linux-kernel-via-struct-device/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-31695
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.t1548
    - cve.2026-31695
logsource:
    product: linux
    category: process_creation
detection:
    selection_sysctl:
        CommandLine|contains:
            - 'kernel.modprobe='
            - 'kernel.modprobe ='
    selection_redirect:
        CommandLine|contains|all:
            - '/proc/sys/kernel/modprobe'
            - '>'
    selection_tee:
        CommandLine|contains|all:
            - 'tee '
            - '/proc/sys/kernel/modprobe'
    condition: 1 of selection_*
falsepositives:
    - Hardening baselines that deliberately set kernel.modprobe to a fixed path or to an empty value
level: critical
```

**Known false positives:**

- CIS/STIG hardening scripts that set kernel.modprobe to a fixed value such as /bin/true or /sbin/modprobe
- Configuration management runs (Ansible, Puppet) applying sysctl baselines

**Tuning notes:** Allow-list the exact value your baseline sets (for example /sbin/modprobe) by adding a NOT clause on the assigned path, and exclude the configuration-management parent process. Any assignment to /tmp, /dev/shm, /var/tmp or a user home directory should be treated as confirmed compromise. Complement with the auditd execve rule on kernel-spawned shells (SIG-002), since the actual kernel memory overwrite is not visible to process telemetry.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unprivileged User + Network Namespace Creation via unshare - CVE-2026-31695 Staging (locked: unlock with TL Creds)
- SELinux Enforcement Disabled - CVE-2026-31695 Exploit Chain Defense Evasion (locked: unlock with TL Creds)
- Audit Tampering and Log Clearing After Root Escalation - CVE-2026-31695 Post-Exploitation Cleanup (locked: unlock with TL Creds)
- virt_wifi Kernel Module Load/Unload Activity - CVE-2026-31695 Exploitation (locked: unlock with TL Creds)
- Kernel Usermode Helper Spawning a Root Shell or Interpreter - modprobe_path Hijack (CVE-2026-31695) (locked: unlock with TL Creds)
- Kernel Version and virt_wifi / User-Namespace Reconnaissance - CVE-2026-31695 Target Selection (locked: unlock with TL Creds)
- virt_wifi / veth Virtual Device Creation by Unprivileged User - CVE-2026-31695 Exploitation Setup (locked: unlock with TL Creds)
- Kernel Oops / KASAN Splat Naming virt_wifi or ethtool-netlink Teardown Path - CVE-2026-31695 Exploit Attempts (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [5-Year-Old Linux Kernel Vulnerability Allows Unprivileged Attackers to Gain Root Access](https://gbhackers.com/5-year-old-linux-kernel-vulnerability/)
- [Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device](https://ptswarm.com/blog/dangerous-device-exploiting-cve-2026-31695-in-the-linux-kernel-via-struct-device/)
- [CVE-2026-31695 Record](https://www.cve.org/CVERecord?id=CVE-2026-31695)
- [NVD - CVE-2026-31695 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-31695)
- [CVE-2026-31695 - OSV.dev](https://osv.dev/vulnerability/CVE-2026-31695)
- [CVE-2026-31695 - SentinelOne Vulnerability Database](https://www.sentinelone.com/vulnerability-database/cve-2026-31695/)
- [CVE-2026-31695 - TuxCare CVE Tracker](https://tuxcare.com/cve-tracker/cve/details/cve-2026-31695/)
- [Linux Stable Kernel Git Repository (fix commits)](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git)
- [CVE-2026-31695 CVEProject/cvelistV5 JSON Record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31695.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5131