Google researchers disclose Linux kernel privilege escalation PoC

Security researchers have publicly disclosed technical details and a working proof-of-concept (PoC) exploit for a high-severity Linux kernel vulnerability, tracked as CVE-2026-31419, with a CVSS v3.1 score of 7.8. The flaw allows local attackers to elevate privileges to root. The disclosure states there is no confirmed exploitation in the wild at this time, and urges administrators to update to patched upstream kernels to protect multi-tenant systems.

The article notes the vulnerability affects Linux kernels in versions from 5.17-rc1 up to 7.0-rc6 when compiled with bonding support, with affected distributions including Red Hat Enterprise Linux 8, 9, and 10.

The vulnerability stems from a double-free race condition in the network bonding driver, specifically bond_xmit_broadcast in drivers/net/bonding/bond_main.c. During broadcast transmissions, the kernel clones the socket buffer for earlier slaves but reuses the original for the final slave; concurrent changes to the slave list can cause the final slave to be misidentified, leading to a double free of the original socket buffer and a use-after-free in the kernel slab allocator.

The PoC reportedly expands the race window using network emulation delays and employs socket buffer spraying, followed by a stack-pivot technique described as Xen to bypass kernel protections and achieve kernel execution. The article credits the kernelCTF competition work and points to a Google security research repository for the full vulnerability write-up and PoC.

Patching is described as replacing dynamic slave checks with a fixed snapshot count; in the interim, administrators are advised to restrict unprivileged user namespaces or remove the bonding module where feasible, while applying patches listed as 060d83bb6147c36fc21134d5b332d266b8c176bc, df690112b2172e8eb0f4dd8ec1019b65ee979203, 00752893f96b344f258c9c6de18b33171ac4872c, 2de5c8eea0a9db99dae7c36f4b541b74b41d3a04 (and 13 more).