Threat video1:00
CVE-2026-31695 Linux virt_wifi Privesc: Detection & IOCs
Popov's exploit turns a five-year-old virt_wifi flaw into root on Fedora 44 Server; hunt it with 9 detection rules, 5 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-31695 Linux virt_wifi Privesc: Detection & IOCs →
Chapters
- 0:00The hookAbout five-year virt_wifi vulnerability allows unprivileged root.
- 0:05The storyResearcher reproduced the flaw on Fedora 44.
- 0:12Attack pathFrom unprivileged shell, namespaces set up the race against device teardown.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise2 indicators to hunt: 2 paths.
- 0:37MITRE ATT&CK techniques7 ATT&CK techniques, from execution to discovery.
- 0:42Remediation3 steps now: Blacklist the virt_wifi kernel module where it is not required.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About five-year virt_wifi vulnerability allows unprivileged root.
0:06Researcher reproduced the flaw on Fedora 44.
0:09Working exploit published.
0:12From unprivileged shell, namespaces set up the race against device teardown.
0:17Hijacking a callback to write kernel, then disabling SELinux.
0:21Achieves full root.
0:26No threat actor: this was defensive research.
0:312 indicators to hunt: 2 paths.
0:387 ATT&CK techniques, from execution to discovery.
0:433 steps now: Blacklist the virt_wifi kernel module where it is not required.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.