CVE-2026-31399

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31399", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.085Z", "datePublished": "2026-04-03T15:16:03.246Z", "dateUpdated": "2026-11-05T21:33:49.321Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:04:55.198Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\"libnvdimm: Hold reference on parent while\nscheduling async init\") correctly added a reference on the parent device\nto be held until asynchronous initialization was complete. However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed. Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix. Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvdimm/bus.c"], "versions": [{"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "6fc36c2a925ceaba203eb13d75a8f0879a2c121b", "status": "affected", "versionType": "git"}, {"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "a36cf138500e56f50db9f9a33222df6969b38326", "status": "affected", "versionType": "git"}, {"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d", "status": "affected", "versionType": "git"}, {"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e", "status": "affected", "versionType": "git"}, {"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "2c638259ad750833fd46a0cf57672a618542d84c", "status": "affected", "versionType": "git"}, {"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "a226e5b49e5fe8c98b14f8507de670189d191348", "status": "affected", "versionType": "git"}, {"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "84af19855d1abdee3c9d57c0684e2868e391793c", "status": "affected", "versionType": "git"}, {"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "a8aec14230322ed8f1e8042b6d656c1631d41163", "status": "affected", "versionType": "git"}, {"version": "8954771abdea5c34280870e35592c7226a816d95", "status": "affected", "versionType": "git"}, {"version": "3e63a7f25cc85d3d3e174b9b0e3489ebb7eaf4ab", "status": "affected", "versionType": "git"}, {"version": "1490de2bb0836fc0631c04d0559fdf81545b672f", "status": "affected", "versionType": "git"}, {"version": "e31a8418c8df7e6771414f99ed3d95ba8aca4e05", "status": "affected", "versionType": "git"}, {"version": "4f1a55a4f990016406147cf3e0c9487bf83e50f0", "status": "affected", "versionType": "git"}, {"version": "4.4.164", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.137", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.81", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.18.19", "lessThan": "4.19", "status": "affected", "versionType": "semver"}, {"version": "4.19.2", "lessThan": "4.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvdimm/bus.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.164"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.137"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b"}, {"url": "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326"}, {"url": "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d"}, {"url": "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e"}, {"url": "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c"}, {"url": "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348"}, {"url": "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c"}, {"url": "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163"}], "title": "nvdimm/bus: Fix potential use after free in asynchronous initialization", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31399", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:32:10.448630Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:49.321Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31399", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:32:10.448630Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:32:11.436Z"}}], "cna": {"title": "nvdimm/bus: Fix potential use after free in asynchronous initialization", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "6fc36c2a925ceaba203eb13d75a8f0879a2c121b", "versionType": "git"}, {"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "a36cf138500e56f50db9f9a33222df6969b38326", "versionType": "git"}, {"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d", "versionType": "git"}, {"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e", "versionType": "git"}, {"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "2c638259ad750833fd46a0cf57672a618542d84c", "versionType": "git"}, {"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "a226e5b49e5fe8c98b14f8507de670189d191348", "versionType": "git"}, {"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "84af19855d1abdee3c9d57c0684e2868e391793c", "versionType": "git"}, {"status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "lessThan": "a8aec14230322ed8f1e8042b6d656c1631d41163", "versionType": "git"}, {"status": "affected", "version": "8954771abdea5c34280870e35592c7226a816d95", "versionType": "git"}, {"status": "affected", "version": "3e63a7f25cc85d3d3e174b9b0e3489ebb7eaf4ab", "versionType": "git"}, {"status": "affected", "version": "1490de2bb0836fc0631c04d0559fdf81545b672f", "versionType": "git"}, {"status": "affected", "version": "e31a8418c8df7e6771414f99ed3d95ba8aca4e05", "versionType": "git"}, {"status": "affected", "version": "4f1a55a4f990016406147cf3e0c9487bf83e50f0", "versionType": "git"}, {"status": "affected", "version": "4.4.164", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.9.137", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.81", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.18.19", "lessThan": "4.19", "versionType": "semver"}, {"status": "affected", "version": "4.19.2", "lessThan": "4.20", "versionType": "semver"}], "programFiles": ["drivers/nvdimm/bus.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nvdimm/bus.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b"}, {"url": "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326"}, {"url": "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d"}, {"url": "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e"}, {"url": "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c"}, {"url": "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348"}, {"url": "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c"}, {"url": "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\"libnvdimm: Hold reference on parent while\nscheduling async init\") correctly added a reference on the parent device\nto be held until asynchronous initialization was complete. However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed. Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix. Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.167", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.78", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.20", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.10", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.4.164"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.137"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.81"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.18.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:04:55.198Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31399", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:49.321Z", "dateReserved": "2026-03-09T15:48:24.085Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-03T15:16:03.246Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvdimm/bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6fc36c2a925ceaba203eb13d75a8f0879a2c121b", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"lessThan": "a36cf138500e56f50db9f9a33222df6969b38326", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"lessThan": "9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"lessThan": "e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"lessThan": "2c638259ad750833fd46a0cf57672a618542d84c", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"lessThan": "a226e5b49e5fe8c98b14f8507de670189d191348", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"lessThan": "84af19855d1abdee3c9d57c0684e2868e391793c", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"lessThan": "a8aec14230322ed8f1e8042b6d656c1631d41163", "status": "affected", "version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5", "versionType": "git"}, {"status": "affected", "version": "8954771abdea5c34280870e35592c7226a816d95", "versionType": "git"}, {"status": "affected", "version": "3e63a7f25cc85d3d3e174b9b0e3489ebb7eaf4ab", "versionType": "git"}, {"status": "affected", "version": "1490de2bb0836fc0631c04d0559fdf81545b672f", "versionType": "git"}, {"status": "affected", "version": "e31a8418c8df7e6771414f99ed3d95ba8aca4e05", "versionType": "git"}, {"status": "affected", "version": "4f1a55a4f990016406147cf3e0c9487bf83e50f0", "versionType": "git"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.164", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.137", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.81", "versionType": "semver"}, {"lessThan": "4.19", "status": "affected", "version": "4.18.19", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvdimm/bus.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F465C16-7558-45C0-8A57-E91446282ED2", "versionEndExcluding": "4.5", "versionStartIncluding": "4.4.164", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "37605FCB-BF78-48D6-8838-00E69121C271", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.137", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E3D2C10-16F9-4F31-94C6-EBE99C89FF70", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.81", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9D418973-A1B7-4F79-B990-AFFA8B41983C", "versionEndExcluding": "4.19", "versionStartIncluding": "4.18.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "38D904CC-7C9A-4A9A-9A82-96FD6C821BB3", "versionEndExcluding": "5.10.253", "versionStartIncluding": "4.19.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\"libnvdimm: Hold reference on parent while\nscheduling async init\") correctly added a reference on the parent device\nto be held until asynchronous initialization was complete. However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed. Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix. Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvdimm/bus: Soluciona un posible uso despu\u00e9s de liberar en la inicializaci\u00f3n as\u00edncrona\n\nDingisoul con KASAN informa de un uso despu\u00e9s de liberar si device_add() falla en nd_async_device_register().\n\nEl commit b6eae0f61db2 ('libnvdimm: Mantener referencia en el padre mientras se programa la inicializaci\u00f3n as\u00edncrona') a\u00f1adi\u00f3 correctamente una referencia en el dispositivo padre para ser mantenida hasta que la inicializaci\u00f3n as\u00edncrona estuviera completa. Sin embargo, si device_add() resulta en un fallo de asignaci\u00f3n, el contador de referencias del dispositivo cae a 0 antes de que se acceda al puntero padre. Resultando as\u00ed en un uso despu\u00e9s de liberar.\n\nLa IA del bot de errores identific\u00f3 correctamente la soluci\u00f3n. Guarda una referencia al puntero padre para ser utilizada para liberar la referencia padre independientemente del resultado de device_add()."}], "id": "CVE-2026-31399", "lastModified": "2026-11-05T22:18:28.600", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31399", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:32:10.448630Z", "version": "2.0.3"}}]}, "published": "2026-04-03T16:16:38.410", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nvdimm/bus: Fix potential use after free in asynchronous initialization", "id": "2454871", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454871"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's nvdimm/bus component. During asynchronous device initialization, if the device_add() function fails in nd_async_device_register(), a use-after-free vulnerability can occur. This happens because the device's reference count drops to zero before the parent pointer is accessed, leading to memory corruption. A local attacker could potentially exploit this to cause system instability or execute arbitrary code."], "name": "CVE-2026-31399", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31399\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31399\nhttps://lore.kernel.org/linux-cve-announce/2026040326-CVE-2026-31399-9b84@gregkh/T"], "statement": "This vulnerability affects systems with NVDIMM (Non-Volatile DIMM) persistent memory hardware. The issue only manifests during an unlikely error path when device_add() fails due to allocation failure during asynchronous initialization. Systems without NVDIMM hardware are not affected, and the error condition is rare under normal memory conditions.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6eae0f61db27748606cc00dafcfd1e2c032f0a5,9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6eae0f61db27748606cc00dafcfd1e2c032f0a5,e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6eae0f61db27748606cc00dafcfd1e2c032f0a5,2c638259ad750833fd46a0cf57672a618542d84c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6eae0f61db27748606cc00dafcfd1e2c032f0a5,a226e5b49e5fe8c98b14f8507de670189d191348)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6eae0f61db27748606cc00dafcfd1e2c032f0a5,84af19855d1abdee3c9d57c0684e2868e391793c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b6eae0f61db27748606cc00dafcfd1e2c032f0a5,a8aec14230322ed8f1e8042b6d656c1631d41163)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8954771abdea5c34280870e35592c7226a816d95"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3e63a7f25cc85d3d3e174b9b0e3489ebb7eaf4ab"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1490de2bb0836fc0631c04d0559fdf81545b672f"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "e31a8418c8df7e6771414f99ed3d95ba8aca4e05"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4f1a55a4f990016406147cf3e0c9487bf83e50f0"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.167,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.130,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.78,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.20,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.10,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-03T21:13:14.345955+00:00", "updated": "2026-05-20T16:30:14.811589+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}