CVE-2026-31442

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31442", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.090Z", "datePublished": "2026-04-22T13:53:39.895Z", "dateUpdated": "2026-10-19T18:35:48.223Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:34.443Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it's possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable FLR recovery path is reached through local use of an Intel IDXD/DSA/IAA device, such as submitting descriptors through an enabled user work queue character device or otherwise causing the local PCI function to halt and reset.\nAC:L - A local attacker with access to an enabled work queue can repeatedly drive descriptor submission and memory pressure to make a second FLR hit the stale saved-state pointer path; there is no victim interaction or uncontrollable race required.\nPR:L - Triggering the path requires local authorization to use the configured IDXD work queue/device, but not real init-namespace root once the accelerator is exposed for user applications.\nUI:N - No separate victim action is needed after the attacker can access the local accelerator interface and trigger the reset sequence.\nS:U - The flaw corrupts or crashes the same host kernel/driver security authority; it is not a VM escape or IOMMU boundary bypass by itself.\nC:H - The stale `idxd->idxd_saved` pointer is a kernel use-after-free during reset restoration, and the freed object contains pointers and state later dereferenced by the driver, making high confidentiality impact defensible.\nI:H - The use-after-free can cause the driver to restore configuration from attacker-reclaimable freed memory and dereference/free stale subpointers, making kernel memory corruption and control-flow compromise plausible.\nA:H - Even without full exploitation, dereferencing the freed saved-state structure during FLR completion can cause an invalid memory access, oops, panic, or persistent device/kernel denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/idxd/init.c"], "versions": [{"version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "lessThan": "504c0e6751001ac46917c73e703f2b1b92cfc026", "status": "affected", "versionType": "git"}, {"version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "lessThan": "867d0c801f21370d561420fa32f2ea1a7dc3a22d", "status": "affected", "versionType": "git"}, {"version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "lessThan": "d6077df7b75d26e4edf98983836c05d00ebabd8d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/idxd/init.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/504c0e6751001ac46917c73e703f2b1b92cfc026"}, {"url": "https://git.kernel.org/stable/c/867d0c801f21370d561420fa32f2ea1a7dc3a22d"}, {"url": "https://git.kernel.org/stable/c/d6077df7b75d26e4edf98983836c05d00ebabd8d"}], "title": "dmaengine: idxd: Fix possible invalid memory access after FLR", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31442", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:09:18.455036Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:35:48.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31442", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:09:18.455036Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:09:19.039Z"}}], "cna": {"title": "dmaengine: idxd: Fix possible invalid memory access after FLR", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable FLR recovery path is reached through local use of an Intel IDXD/DSA/IAA device, such as submitting descriptors through an enabled user work queue character device or otherwise causing the local PCI function to halt and reset.\nAC:L - A local attacker with access to an enabled work queue can repeatedly drive descriptor submission and memory pressure to make a second FLR hit the stale saved-state pointer path; there is no victim interaction or uncontrollable race required.\nPR:L - Triggering the path requires local authorization to use the configured IDXD work queue/device, but not real init-namespace root once the accelerator is exposed for user applications.\nUI:N - No separate victim action is needed after the attacker can access the local accelerator interface and trigger the reset sequence.\nS:U - The flaw corrupts or crashes the same host kernel/driver security authority; it is not a VM escape or IOMMU boundary bypass by itself.\nC:H - The stale `idxd->idxd_saved` pointer is a kernel use-after-free during reset restoration, and the freed object contains pointers and state later dereferenced by the driver, making high confidentiality impact defensible.\nI:H - The use-after-free can cause the driver to restore configuration from attacker-reclaimable freed memory and dereference/free stale subpointers, making kernel memory corruption and control-flow compromise plausible.\nA:H - Even without full exploitation, dereferencing the freed saved-state structure during FLR completion can cause an invalid memory access, oops, panic, or persistent device/kernel denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "lessThan": "504c0e6751001ac46917c73e703f2b1b92cfc026", "versionType": "git"}, {"status": "affected", "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "lessThan": "867d0c801f21370d561420fa32f2ea1a7dc3a22d", "versionType": "git"}, {"status": "affected", "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "lessThan": "d6077df7b75d26e4edf98983836c05d00ebabd8d", "versionType": "git"}], "programFiles": ["drivers/dma/idxd/init.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/dma/idxd/init.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/504c0e6751001ac46917c73e703f2b1b92cfc026"}, {"url": "https://git.kernel.org/stable/c/867d0c801f21370d561420fa32f2ea1a7dc3a22d"}, {"url": "https://git.kernel.org/stable/c/d6077df7b75d26e4edf98983836c05d00ebabd8d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it's possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:34.443Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31442", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:35:48.223Z", "dateReserved": "2026-03-09T15:48:24.090Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:53:39.895Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/idxd/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "504c0e6751001ac46917c73e703f2b1b92cfc026", "status": "affected", "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "versionType": "git"}, {"lessThan": "867d0c801f21370d561420fa32f2ea1a7dc3a22d", "status": "affected", "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "versionType": "git"}, {"lessThan": "d6077df7b75d26e4edf98983836c05d00ebabd8d", "status": "affected", "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/idxd/init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A92793EC-8117-409C-996C-47A04124C722", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it's possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ndmaengine: idxd: Correcci\u00f3n de posible acceso a memoria no v\u00e1lido despu\u00e9s de FLR\n\nEn el caso de que el primer Function Level Reset (FLR) concluya correctamente, pero en el segundo FLR el \u00e1rea de trabajo para la configuraci\u00f3n guardada no pueda asignarse, es posible que ocurra un acceso a memoria no v\u00e1lido.\n\nSiempre establecer el \u00e1rea de trabajo desasignada a NULL despu\u00e9s de que FLR se complete."}], "id": "CVE-2026-31442", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31442", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:09:18.455036Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:37.703", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/504c0e6751001ac46917c73e703f2b1b92cfc026"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/867d0c801f21370d561420fa32f2ea1a7dc3a22d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d6077df7b75d26e4edf98983836c05d00ebabd8d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: dmaengine: idxd: Fix possible invalid memory access after FLR", "id": "2460680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460680"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's dmaengine: idxd component. During a Function Level Reset (FLR), if the system fails to allocate the scratch area for saved configuration after a successful initial reset, it can lead to an invalid memory access. This vulnerability could result in system instability or denial of service."], "name": "CVE-2026-31442", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31442\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31442\nhttps://lore.kernel.org/linux-cve-announce/2026042244-CVE-2026-31442-dece@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["*"], "status": "affected", "versions": {"scheme": "code_commit", "value": "[98d187a989036096feaa2fef1ec3b2240ecdeacf,504c0e6751001ac46917c73e703f2b1b92cfc026)"}}, {"platform": ["*"], "status": "affected", "versions": {"scheme": "code_commit", "value": "[98d187a989036096feaa2fef1ec3b2240ecdeacf,867d0c801f21370d561420fa32f2ea1a7dc3a22d)"}}, {"platform": ["*"], "status": "affected", "versions": {"scheme": "code_commit", "value": "[98d187a989036096feaa2fef1ec3b2240ecdeacf,d6077df7b75d26e4edf98983836c05d00ebabd8d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": ["*"], "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": ["*"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": ["*"], "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": ["*"], "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": ["*"], "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-22T16:45:21.256051+00:00", "updated": "2026-10-19T21:30:03.920107+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}