CVE-2026-31468

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31468", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.097Z", "datePublished": "2026-04-22T13:53:57.583Z", "dateUpdated": "2026-10-19T18:35:49.671Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:47.492Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Fix double free in dma-buf feature\n\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\nown advice to only use dma_buf_put() after dma_buf_export(), instead\nfalling through the entire unwind chain. In the unlikely event that\nwe encounter file descriptor exhaustion, this can result in an\nunbalanced refcount on the vfio device and double free of allocated\nobjects.\n\nAvoid this by moving the \"put\" directly into the error path and return\nthe errno rather than entering the unwind chain."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through a local VFIO device file ioctl, specifically VFIO_DEVICE_FEATURE on a VFIO PCI device. It is not reachable from network packets, adjacent radio traffic, or physical hotplug alone.\nAC:L - Once a caller has an opened VFIO PCI device that supports the dma-buf feature, the failure path can be driven by attacker-controlled file descriptor exhaustion and valid ioctl inputs. The relevant condition is under the attacker's process control rather than a race or external timing dependency.\nPR:L - The attacker needs local access to an opened/access-granted VFIO device fd, which is normally delegated by device node permissions or virtualization management policy. The ioctl path itself does not require real init-namespace root for normal IOMMU-backed VFIO devices, and VFIO is not made reachable through unprivileged user namespaces.\nUI:N - No victim interaction is required after the attacker has the VFIO device fd. The attacker directly invokes the ioctl and controls the file descriptor exhaustion condition.\nS:U - The bug corrupts kernel/VFIO memory from a local kernel interface, so the vulnerable and impacted security authority is the same kernel instance. This is not a guest-to-host escape path or a direct IOMMU/DMA boundary bypass by itself.\nC:H - The old unwind path calls dma_buf_put(), whose release callback frees the private VFIO dma-buf object and phys_vec, then continues to dereference and free those same objects again. This double free/use-after-free style heap corruption is reasonably exploitable for kernel memory disclosure primitives.\nI:H - The double free of attacker-influenced kernel heap objects can corrupt allocator metadata or enable reuse of freed objects, which is a kernel memory corruption primitive. Under the required overestimation rule, this supports high integrity impact due to plausible arbitrary write or code execution.\nA:H - Even without full exploitation, the double free and unbalanced VFIO device reference can trigger allocator corruption, UAF, oops, or panic. The attacker can repeat the ioctl path to cause a reliable local denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "versions": [{"version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "83ad334afc9a645cef1062f5346526b1e36d6516", "status": "affected", "versionType": "git"}, {"version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "e98137f0a874ab36d0946de4707aa48cb7137d1c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516"}, {"url": "https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c"}], "title": "vfio/pci: Fix double free in dma-buf feature", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31468", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:09:44.917281Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:35:49.671Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31468", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:09:44.917281Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:09:45.523Z"}}], "cna": {"title": "vfio/pci: Fix double free in dma-buf feature", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through a local VFIO device file ioctl, specifically VFIO_DEVICE_FEATURE on a VFIO PCI device. It is not reachable from network packets, adjacent radio traffic, or physical hotplug alone.\nAC:L - Once a caller has an opened VFIO PCI device that supports the dma-buf feature, the failure path can be driven by attacker-controlled file descriptor exhaustion and valid ioctl inputs. The relevant condition is under the attacker's process control rather than a race or external timing dependency.\nPR:L - The attacker needs local access to an opened/access-granted VFIO device fd, which is normally delegated by device node permissions or virtualization management policy. The ioctl path itself does not require real init-namespace root for normal IOMMU-backed VFIO devices, and VFIO is not made reachable through unprivileged user namespaces.\nUI:N - No victim interaction is required after the attacker has the VFIO device fd. The attacker directly invokes the ioctl and controls the file descriptor exhaustion condition.\nS:U - The bug corrupts kernel/VFIO memory from a local kernel interface, so the vulnerable and impacted security authority is the same kernel instance. This is not a guest-to-host escape path or a direct IOMMU/DMA boundary bypass by itself.\nC:H - The old unwind path calls dma_buf_put(), whose release callback frees the private VFIO dma-buf object and phys_vec, then continues to dereference and free those same objects again. This double free/use-after-free style heap corruption is reasonably exploitable for kernel memory disclosure primitives.\nI:H - The double free of attacker-influenced kernel heap objects can corrupt allocator metadata or enable reuse of freed objects, which is a kernel memory corruption primitive. Under the required overestimation rule, this supports high integrity impact due to plausible arbitrary write or code execution.\nA:H - Even without full exploitation, the double free and unbalanced VFIO device reference can trigger allocator corruption, UAF, oops, or panic. The attacker can repeat the ioctl path to cause a reliable local denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "83ad334afc9a645cef1062f5346526b1e36d6516", "versionType": "git"}, {"status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "e98137f0a874ab36d0946de4707aa48cb7137d1c", "versionType": "git"}], "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516"}, {"url": "https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Fix double free in dma-buf feature\n\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\nown advice to only use dma_buf_put() after dma_buf_export(), instead\nfalling through the entire unwind chain. In the unlikely event that\nwe encounter file descriptor exhaustion, this can result in an\nunbalanced refcount on the vfio device and double free of allocated\nobjects.\n\nAvoid this by moving the \"put\" directly into the error path and return\nthe errno rather than entering the unwind chain."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:47.492Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31468", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:35:49.671Z", "dateReserved": "2026-03-09T15:48:24.097Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:53:57.583Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "83ad334afc9a645cef1062f5346526b1e36d6516", "status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "versionType": "git"}, {"lessThan": "e98137f0a874ab36d0946de4707aa48cb7137d1c", "status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Fix double free in dma-buf feature\n\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\nown advice to only use dma_buf_put() after dma_buf_export(), instead\nfalling through the entire unwind chain. In the unlikely event that\nwe encounter file descriptor exhaustion, this can result in an\nunbalanced refcount on the vfio device and double free of allocated\nobjects.\n\nAvoid this by moving the \"put\" directly into the error path and return\nthe errno rather than entering the unwind chain."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvfio/pci: Correcci\u00f3n de doble liberaci\u00f3n en la caracter\u00edstica dma-buf\n\nLa ruta de error a trav\u00e9s de vfio_pci_core_feature_dma_buf() ignora su propio consejo de usar dma_buf_put() solo despu\u00e9s de dma_buf_export(), cayendo en su lugar por toda la cadena de desenrollado. En el improbable caso de que encontremos agotamiento de descriptores de archivo, esto puede resultar en un recuento de referencias desequilibrado en el dispositivo vfio y doble liberaci\u00f3n de objetos asignados.\n\nEvite esto al mover el put directamente a la ruta de error y devolver el errno en lugar de entrar en la cadena de desenrollado."}], "id": "CVE-2026-31468", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31468", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:09:44.917281Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:43.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-415"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: vfio/pci: Fix double free in dma-buf feature", "id": "2460712", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460712"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-763", "details": ["A flaw was found in the Linux kernel's vfio/pci dma-buf feature. An issue in the error handling of the `vfio_pci_core_feature_dma_buf()` function can lead to a double free of allocated memory. This can occur under specific conditions, such as file descriptor exhaustion, potentially causing system instability or a denial of service (DoS)."], "name": "CVE-2026-31468", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31468\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31468\nhttps://lore.kernel.org/linux-cve-announce/2026042253-CVE-2026-31468-13b8@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5d74781ebc86c5fa9e9d6934024c505412de9b52,83ad334afc9a645cef1062f5346526b1e36d6516)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5d74781ebc86c5fa9e9d6934024c505412de9b52,e98137f0a874ab36d0946de4707aa48cb7137d1c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-22T17:00:11.728429+00:00", "updated": "2026-05-07T23:45:40.661268+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}