CVE-2026-31490

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31490", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.102Z", "datePublished": "2026-04-22T13:54:14.241Z", "dateUpdated": "2026-08-05T12:23:02.564Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:02.564Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix use-after-free in migration restore\n\nWhen an error is returned from xe_sriov_pf_migration_restore_produce(),\nthe data pointer is not set to NULL, which can trigger use-after-free\nin subsequent .write() calls.\nSet the pointer to NULL upon error to fix the problem.\n\n(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable restore write path is reached through local kernel interfaces, primarily the Xe VFIO migration resume data fd and also PF debugfs migration_data, not by network packets.\nAC:L - An attacker with access to the migration write interface can deliberately write a malformed complete packet, get an error from restore production, and then issue a subsequent write against the stale pending pointer.\nPR:L - The debugfs path is root-only, but the same helper is exposed through xe-vfio-pci migration to a process with an assigned VFIO device fd, which is commonly delegated to an unprivileged VMM user.\nUI:N - No victim action is needed once the attacker can operate the local VFIO/debugfs migration interface; the attacker directly performs the state transition and writes restore data.\nS:U - The bug corrupts host kernel memory from a host kernel driver path, so the impact remains within the same kernel security authority.\nC:H - This is a kernel use-after-free on a packet object containing attacker-influenced header and buffer pointer state, which can plausibly be shaped into disclosure of kernel memory.\nI:H - The stale packet pointer is reused on later writes, including copy_from_user through fields from freed/reallocated memory, making arbitrary kernel memory corruption defensible.\nA:H - At minimum the dangling pointer can be triggered repeatedly to cause kernel oops, panic, or device/host instability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_packet.c"], "versions": [{"version": "1ed30397c0b92b97381dbd11362fdbbf93e046d2", "lessThan": "e28552b4ddea5cb4725380dd08237831af835124", "status": "affected", "versionType": "git"}, {"version": "1ed30397c0b92b97381dbd11362fdbbf93e046d2", "lessThan": "87997b6c6516e049cbaf2fc6810b213d587a06b1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_packet.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e28552b4ddea5cb4725380dd08237831af835124"}, {"url": "https://git.kernel.org/stable/c/87997b6c6516e049cbaf2fc6810b213d587a06b1"}], "title": "drm/xe/pf: Fix use-after-free in migration restore", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e28552b4ddea5cb4725380dd08237831af835124", "status": "affected", "version": "1ed30397c0b92b97381dbd11362fdbbf93e046d2", "versionType": "git"}, {"lessThan": "87997b6c6516e049cbaf2fc6810b213d587a06b1", "status": "affected", "version": "1ed30397c0b92b97381dbd11362fdbbf93e046d2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_sriov_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5054C854-C253-4020-BD2E-2BDA121E424C", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix use-after-free in migration restore\n\nWhen an error is returned from xe_sriov_pf_migration_restore_produce(),\nthe data pointer is not set to NULL, which can trigger use-after-free\nin subsequent .write() calls.\nSet the pointer to NULL upon error to fix the problem.\n\n(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/pf: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en la restauraci\u00f3n de migraci\u00f3n\n\nCuando se devuelve un error desde xe_sriov_pf_migration_restore_produce(), el puntero de datos no se establece en NULL, lo que puede desencadenar un uso despu\u00e9s de liberaci\u00f3n en llamadas .write() posteriores.\nEstablecer el puntero en NULL ante un error para solucionar el problema.\n\n(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)"}], "id": "CVE-2026-31490", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-22T14:16:46.763", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/87997b6c6516e049cbaf2fc6810b213d587a06b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e28552b4ddea5cb4725380dd08237831af835124"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/xe/pf: Fix use-after-free in migration restore", "id": "2460652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460652"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's `drm/xe/pf` component. This vulnerability occurs when an error is returned during a migration restore operation, specifically from the `xe_sriov_pf_migration_restore_produce()` function, and the associated data pointer is not correctly cleared. This can lead to a use-after-free condition, which may allow an attacker to corrupt memory or cause a system crash, resulting in a denial of service."], "name": "CVE-2026-31490", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31490\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31490\nhttps://lore.kernel.org/linux-cve-announce/2026042201-CVE-2026-31490-8635@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ed30397c0b92b97381dbd11362fdbbf93e046d2,e28552b4ddea5cb4725380dd08237831af835124)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1ed30397c0b92b97381dbd11362fdbbf93e046d2,87997b6c6516e049cbaf2fc6810b213d587a06b1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:55:46.541376+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that includes commit 4f53d8c6 which nulls the pointer on error", "If upgrading kernel is not immediately feasible, disable or blacklist the DRM XE driver and the XR SRIoV functionality to prevent the buggy write path", "Validate the applied changes by reproducing migration restore failure scenarios to confirm the issue is resolved"], "summary": {"action": "Immediate Patch", "impact": "Use\u2011After\u2011Free in DRM XE driver"}, "threat_synthesis": {"affected_systems": "Linux kernels built before the inclusion of commit 4f53d8c6, which nulls the pointer on error, are vulnerable. Any distribution whose kernel version predates this commit remains affected until the patch is applied.", "description_and_impact": "In the Linux kernel\u2019s DRM XE driver, a use\u2011after\u2011free bug was introduced when xe_sriov_pf_migration_restore_produce() returned an error without nulling the data pointer. Subsequent .write() invocations could dereference freed memory, leading to a kernel crash, service disruption, or potentially compromise control of the kernel.", "risk_and_exploitability": "The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1%, showing a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require triggering the buggy write sequence after a migration restore failure, which typically demands local or privileged access. The potential for denial of service and, if the attacker can influence the write path, code execution is also inferred."}}}}, "created": "2026-04-22T20:15:20.262356+00:00", "updated": "2026-04-28T21:00:14.765419+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}