Technical Summary

CVE-2026-31516 addresses a race condition in the Linux kernel's XFRM subsystem where the policy_hthresh.work work item can be queued onto the system workqueue via XFRM_MSG_NEWSPDINFO requests. The callback xfrm_hash_rebuild() accesses the enclosing struct net via container_of(). If the network namespace is torn down before this work executes, the struct net may have been freed, leading to a use-after-free vulnerability. The fix synchronizes policy_hthresh.work in xfrm_policy_fini() to ensure the work does not outlive the network namespace teardown, preventing stale memory access. This vulnerability affects linux-aws kernel versions prior to 6.8.0-1061.64~22.04.1, 6.8.0-1062.69~22.04.1, 6.8.0-1063.71~22.04.1, 6.8.0-1064.72~22.04.1, and 6.8.0-136.136~22.04.1. The issue has been patched in these and later versions. The CVSS 3.1 score is 7.8 (High), reflecting local attack vector with low complexity, requiring privileges, no user interaction, and impacts confidentiality, integrity, and availability.