In the Linux kernel, the following vulnerability has been resolved:
wireguard: device: use exitrtnl callback instead of manual rtnllock in pre_exit
wgnetnspreexit() manually acquires rtnllock() inside the pernet .preexit callback. This causes a hung task when another thread holds rtnlmutex - the cleanupnet workqueue (or the setupnet failure rollback path) blocks indefinitely in wgnetnspre_exit() waiting to acquire the lock.
Convert to .exitrtnl, introduced in commit 7a60d91c690b ("net: Add ->exitrtnl() hook to struct pernetoperations."), where the framework already holds RTNL and batches all callbacks under a single rtnllock()/rtnl_unlock() pair, eliminating the contention window.
The rcuassignpointer(wg->creatingnet, NULL) is safe to move from .preexit to .exitrtnl (which runs after synchronizercu()) because all RCU readers of creatingnet either use maybegetnet() - which returns NULL for a dying namespace with zero refcount - or access net->userns which remains valid throughout the entire opsundolist sequence.
[ Jason: added __net_exit and _readmostly annotations that were missing. ]
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31579.json",
"cna_assigner": "Linux"
}