A previously unnoticed vulnerability in the Linux kernel, which remained undetected for over five years, allows an unprivileged local user to gain full root control of a system This article explores virt_wifi remove set_netdev_dev. . This flaw, tracked as CVE-2026-31695, was discovered and patched by researcher Alexander Popov, who has now published a working exploit against a default Fedora 44 Server installation on x86_64 architecture.
This is a critical issue involving a use-after-free condition within the virt_wifi driver, which is classified as CWE-416 by the National Vulnerability Database. The driver improperly linked each virtual network device to its lower device using SET_NETDEV_DEV(dev, &priv->lowerdev->dev), leading to potential memory corruption and unauthorized access. The virtual device's dev.parent field then points to freed memory, and ethnl_ops_begin() calls pm_runtime_get_sync(dev->dev.parent) during an ethtool operation.
The upstream fix is titled "wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free." The kernel.org CNA scores the flaw 7.8 High, with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Recent breaches linked the PHP2Shell flaw with the Fragnesia kernel flaw, tracked as CVE-2026-46300, to gain root access on Palo Alto Networks PAN-OS systems. Prior to the latest research, the AppSecure database revealed no known public exploits, an EPSS score of 0.01%, and no CISA KEV entries.
Teams should monitor for repeated creation and removal of virtual network devices and unusual ethtool activity, which could indicate attempts to win the race.
