CVE-2026-31493

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31493", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.102Z", "datePublished": "2026-04-22T13:54:16.255Z", "dateUpdated": "2026-11-05T21:45:02.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:20.213Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c"], "versions": [{"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "8c24b5179af260a5f36571c992d29aab1f448544", "status": "affected", "versionType": "git"}, {"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5", "status": "affected", "versionType": "git"}, {"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "0dd98aea1c0c45987fa2dd92f988b0eb1a72c125", "status": "affected", "versionType": "git"}, {"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "1cf95fe5dc5471efea947b4c6f8913da6bc7976e", "status": "affected", "versionType": "git"}, {"version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "ef3b06742c8a201d0e83edc9a33a89a4fe3009f8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544"}, {"url": "https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5"}, {"url": "https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125"}, {"url": "https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e"}, {"url": "https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}], "title": "RDMA/efa: Fix use of completion ctx after free", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:35:16.910245Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:02.286Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:35:16.910245Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:35:18.659Z"}}], "cna": {"title": "RDMA/efa: Fix use of completion ctx after free", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "8c24b5179af260a5f36571c992d29aab1f448544", "versionType": "git"}, {"status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5", "versionType": "git"}, {"status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "0dd98aea1c0c45987fa2dd92f988b0eb1a72c125", "versionType": "git"}, {"status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "1cf95fe5dc5471efea947b4c6f8913da6bc7976e", "versionType": "git"}, {"status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "lessThan": "ef3b06742c8a201d0e83edc9a33a89a4fe3009f8", "versionType": "git"}], "programFiles": ["drivers/infiniband/hw/efa/efa_com.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/efa/efa_com.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544"}, {"url": "https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5"}, {"url": "https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125"}, {"url": "https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e"}, {"url": "https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:39:20.213Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31493", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:02.286Z", "dateReserved": "2026-03-09T15:48:24.102Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:16.255Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8c24b5179af260a5f36571c992d29aab1f448544", "status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "versionType": "git"}, {"lessThan": "7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5", "status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "versionType": "git"}, {"lessThan": "0dd98aea1c0c45987fa2dd92f988b0eb1a72c125", "status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "versionType": "git"}, {"lessThan": "1cf95fe5dc5471efea947b4c6f8913da6bc7976e", "status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "versionType": "git"}, {"lessThan": "ef3b06742c8a201d0e83edc9a33a89a4fe3009f8", "status": "affected", "version": "68fb9f3e312a36e49fd05ec2d6b668daf2c4931a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "00EAFFC2-EF24-43DB-A137-7A3557D33C50", "versionEndExcluding": "6.18.21", "versionStartIncluding": "5.12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*", "matchCriteriaId": "75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/efa: Corregir el uso del contexto de finalizaci\u00f3n despu\u00e9s de la liberaci\u00f3n\n\nEn el manejo de la finalizaci\u00f3n de la cola de administraci\u00f3n, si el comando de administraci\u00f3n finaliz\u00f3 con error, imprimimos datos del contexto de finalizaci\u00f3n. El problema es que ya liberamos el contexto de finalizaci\u00f3n en el gestor de sondeo/interrupciones, lo que significa que imprimimos datos del contexto en un estado desconocido (podr\u00eda estar ya siendo usado de nuevo).\nCambiar el flujo de env\u00edo de administraci\u00f3n para que la asignaci\u00f3n/desasignaci\u00f3n del contexto sea sim\u00e9trica y la desasignaci\u00f3n se llame despu\u00e9s de cualquier uso potencial del contexto."}], "id": "CVE-2026-31493", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31493", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:35:16.910245Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:47.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/efa: Fix use of completion ctx after free", "id": "2460632", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460632"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's RDMA/efa component. When an admin command completes with an error during admin queue completion handling, the system attempts to print data from a completion context that has already been freed. This use-after-free vulnerability can lead to the disclosure of sensitive information or system instability, as data is accessed from an unknown memory state."], "name": "CVE-2026-31493", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31493\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31493\nhttps://lore.kernel.org/linux-cve-announce/2026042202-CVE-2026-31493-4d67@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[68fb9f3e312a36e49fd05ec2d6b668daf2c4931a,0dd98aea1c0c45987fa2dd92f988b0eb1a72c125)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[68fb9f3e312a36e49fd05ec2d6b668daf2c4931a,1cf95fe5dc5471efea947b4c6f8913da6bc7976e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[68fb9f3e312a36e49fd05ec2d6b668daf2c4931a,ef3b06742c8a201d0e83edc9a33a89a4fe3009f8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T02:46:20.876653+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that includes the patch associated with commit 0dd98aea1c0c45987fa2dd92f988b0eb1a72c125 (or a later stable kernel version).", "If an immediate kernel upgrade is not possible, unload the RDMA/EFA module with `modprobe -r rdma_efa` to prevent the vulnerable code path from executing.", "Regularly review kernel logs such as `dmesg` or `/var/log/kern.log` for anomalous completion messages that could indicate residual use of freed context data."], "summary": {"action": "Patch", "impact": "Potential information disclosure"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the RDMA/EFA driver and do not contain the commit that fixes the bug are vulnerable. The issue affects kernels up through the 7.0 release candidates (rc1 through rc7) as well as older releases such as 5.12. Kernel versions in 7.0 RC8 and later, as well as stable releases after 7.0 incorporating the patch, are considered fixed.", "description_and_impact": "This vulnerability is a use\u2011after\u2011free bug (CWE\u2011416) in the RDMA over Ethernet Fabrics (EFA) subsystem of the Linux kernel. When an admin command fails, the completion handler accesses and prints data from a completion context that has already been freed in the polling or interrupt, causing the kernel to read from an undefined memory region. The effect is to expose data that may have resided in the context to log output or error messages, potentially revealing sensitive information (CWE\u2011825). The flaw does not directly alter program state or crash the kernel; its impact is limited to confidentiality leakage via log leakage.", "risk_and_exploitability": "The EPSS score is below 1\u202f% and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating a very low probability of exploitation. The bug appears to require local privileged execution to trigger the problematic error path in the RDMA/EFA module, making it unlikely to be leveraged remotely. Because the flaw only exposes data when the driver writes it to logs, an attacker would need to analyze those logs locally, further reducing the practical risk. The CVSS score of 7.8 reflects the high confidentiality impact, but overall risk remains moderate given the limited exploitation surface."}}}}, "created": "2026-04-27T19:00:16.373221+00:00", "updated": "2026-04-29T03:00:12.338923+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}