CVE-2026-31644

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31644", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.127Z", "datePublished": "2026-04-24T14:44:58.197Z", "dateUpdated": "2026-08-05T12:24:06.448Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:06.448Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable reload path is reached through local netdev administrative operations such as MTU changes or XDP setup via rtnetlink/sysfs, not by ordinary received packets alone. Network traffic can control subsequent DMA contents after the bad restore, but cannot independently invoke the reload path.\nAC:L - There is no attacker-uncontrolled race; an attacker with the needed local netdev access can repeatedly trigger reloads and influence memory pressure/traffic until allocation failure hits the vulnerable restore path. Under the required uncertainty rule, the allocation-failure condition is treated as low complexity.\nPR:L - The entry points require CAP_NET_ADMIN for the LAN966x netdev's owning network namespace, so privileges are required. In plausible delegated/containerized netns deployments this can be a low-privileged namespace capability rather than init-namespace root, so PR:L is the higher-severity defensible choice.\nUI:N - No victim action is required once the attacker has the required local netdev privileges. The attacker can perform the MTU/XDP operation and generate traffic directly.\nS:U - The corruption impacts kernel memory managed by the same host kernel/driver security authority. It is not a guest-to-host escape or a distinct IOMMU/security-scope crossing.\nC:H - This is a use-after-free of RX DMA pages where stale descriptors can cause hardware DMA into memory reallocated to other kernel subsystems. Such memory corruption is reasonably exploitable for kernel information disclosure.\nI:H - The stale DMA descriptors can write attacker-controlled received frame data into freed/reused kernel pages. That gives a high-integrity kernel memory corruption primitive.\nA:H - The bug can corrupt arbitrary kernel-owned memory or crash/hang the kernel, and the associated page-pool leak can worsen availability. Kernel memory corruption from a UAF warrants high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"], "versions": [{"version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "lessThan": "691082c0b93c13a5e068c0905f673060bddc204e", "status": "affected", "versionType": "git"}, {"version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "lessThan": "92a673019943770930e2a8bfd52e1aad47a1fc1f", "status": "affected", "versionType": "git"}, {"version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "lessThan": "9950e9199b3dfdfbde0b8d96ba947d7b11243801", "status": "affected", "versionType": "git"}, {"version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "lessThan": "59c3d55a946cacdb4181600723c20ac4f4c20c84", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.82", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.23", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.13", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.82"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e"}, {"url": "https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f"}, {"url": "https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801"}, {"url": "https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84"}], "title": "net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "691082c0b93c13a5e068c0905f673060bddc204e", "status": "affected", "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "versionType": "git"}, {"lessThan": "92a673019943770930e2a8bfd52e1aad47a1fc1f", "status": "affected", "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "versionType": "git"}, {"lessThan": "9950e9199b3dfdfbde0b8d96ba947d7b11243801", "status": "affected", "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "versionType": "git"}, {"lessThan": "59c3d55a946cacdb4181600723c20ac4f4c20c84", "status": "affected", "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.82", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.23", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "36D94B3B-76E2-4F07-B407-336CB238EB63", "versionEndExcluding": "6.12.82", "versionStartIncluding": "6.12.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F", "versionEndExcluding": "6.18.23", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4", "versionEndExcluding": "6.19.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*", "matchCriteriaId": "0E698080-7669-4132-8817-4C674EEBCE54", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: lan966x: soluciona el uso despu\u00e9s de liberaci\u00f3n y la fuga en lan966x_fdma_reload()\n\nCuando lan966x_fdma_reload() falla al asignar nuevos b\u00faferes RX, la ruta de restauraci\u00f3n reinicia el DMA usando descriptores antiguos cuyas p\u00e1ginas ya fueron liberadas a trav\u00e9s de lan966x_fdma_rx_free_pages(). Dado que page_pool_put_full_page() puede liberar p\u00e1ginas de vuelta al asignador buddy, el hardware puede realizar DMA en memoria ahora propiedad de otros subsistemas del kernel.\n\nAdem\u00e1s, en la ruta de restauraci\u00f3n, el pool de p\u00e1ginas reci\u00e9n creado (si la asignaci\u00f3n tuvo \u00e9xito parcialmente) es sobrescrito sin ser destruido, provocando su fuga.\n\nSoluciona ambos problemas posponiendo la liberaci\u00f3n de p\u00e1ginas antiguas hasta despu\u00e9s de que la nueva asignaci\u00f3n tenga \u00e9xito. Guarda el array de p\u00e1ginas antiguas antes de la asignaci\u00f3n para que las p\u00e1ginas antiguas puedan ser liberadas en la ruta de \u00e9xito. En la ruta de fallo, los descriptores antiguos, las p\u00e1ginas y el pool de p\u00e1ginas siguen siendo todos v\u00e1lidos, haciendo que la restauraci\u00f3n sea segura. Tambi\u00e9n asegura que la ruta de restauraci\u00f3n vuelva a habilitar NAPI y despierte el netdev, coincidiendo con la ruta de \u00e9xito."}], "id": "CVE-2026-31644", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-24T15:16:43.770", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()", "id": "2461544", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461544"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's `lan966x` network driver. When the `lan966x_fdma_reload()` function encounters an error during the allocation of new receive (RX) buffers, it can lead to a use-after-free condition. This occurs because the system may attempt to restart Direct Memory Access (DMA) operations using memory pages that have already been released. Consequently, the hardware might write data into memory regions that are now allocated to other kernel components, potentially causing memory corruption. This could enable a local attacker to achieve privilege escalation or trigger a system crash (Denial of Service)."], "name": "CVE-2026-31644", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31644\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31644\nhttps://lore.kernel.org/linux-cve-announce/2026042458-CVE-2026-31644-34ba@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[89ba464fcf548d64bc7215dfe769f791330ae8b6,691082c0b93c13a5e068c0905f673060bddc204e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[89ba464fcf548d64bc7215dfe769f791330ae8b6,92a673019943770930e2a8bfd52e1aad47a1fc1f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[89ba464fcf548d64bc7215dfe769f791330ae8b6,9950e9199b3dfdfbde0b8d96ba947d7b11243801)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[89ba464fcf548d64bc7215dfe769f791330ae8b6,59c3d55a946cacdb4181600723c20ac4f4c20c84)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.82,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.23,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.13,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T13:50:20.597538+00:00", "value": {"mitigation_remediation": ["Apply the kernel patch that defers release of old pages until the new allocation succeeds and restores safe DMA behavior, such as updating to Linux kernel 6.12.1 or newer 7.0 releases that contain the fix.", "If an immediate kernel upgrade is not possible, remove or disable the lan966x driver or disable the network interface that uses the FDMA reload path to prevent the flaw from being triggered.", "Ensure that any custom builds or modules for lan966x incorporate the same logic changes\u2014saving the old page array before allocation and freeing it only on successful re\u2011initialization\u2014to eliminate the use\u2011after\u2011free and memory leak."], "summary": {"action": "Immediate Patch", "impact": "Use\u2011After\u2011Free memory corruption allowing DMA into memory owned by other subsystems, potentially enabling arbitrary code execution or privilege escalation"}, "threat_synthesis": {"affected_systems": "All Linux kernel releases that ship the lan966x driver, including kernel 6.12 and the 7.0 release candidates up to rc7. Any system using a network interface based on the lan966x hardware is at risk.", "description_and_impact": "The lan966x network driver contains a use\u2011after\u2011free and memory leak triggered when lan966x_fdma_reload() fails to allocate new receive buffers. The driver attempts to restart DMA with descriptors whose pages have already been freed, exposing the system to DMA writes into memory no longer under its control. This flaw is a form of memory corruption (CWE-416) that can overwrite kernel data structures, and the leaked page pool can further expose kernel memory for manipulation.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.8, indicating high severity. The EPSS score is below 1\u202f%, suggesting very low probability of exploitation in the wild. The bug is not listed in the CISA KEV catalog, and exploitation would likely require an attacker with local privileged or kernel access to trigger the DMA reload and map the freed pages into the target's address space. Overall, the attack surface is narrow, but the impact is severe should the flaw be leveraged."}}}}, "created": "2026-04-27T21:00:11.927084+00:00", "updated": "2026-04-28T14:00:16.492228+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}