Skip to main content

Linux Kernel CVE-2026-31468

| EUVDEUVD-2026-24815 HIGH
Double Free (CWE-415)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-489p-vfcx-x55r
Information Disclosure Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Generated
Apr 27, 2026 - 14:30 vuln.today
CVSS changed
Apr 27, 2026 - 14:22 NVD
7.8 (HIGH)
Patch released
Apr 27, 2026 - 14:16 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24815
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Fix double free in dma-buf feature

The error path through vfio_pci_core_feature_dma_buf() ignores its own advice to only use dma_buf_put() after dma_buf_export(), instead falling through the entire unwind chain. In the unlikely event that we encounter file descriptor exhaustion, this can result in an unbalanced refcount on the vfio device and double free of allocated objects.

Avoid this by moving the "put" directly into the error path and return the errno rather than entering the unwind chain.

AnalysisAI

Memory corruption in the Linux kernel VFIO PCI subsystem allows local authenticated users to trigger double-free conditions and potentially execute arbitrary code with kernel privileges. The vulnerability stems from an incorrect error-handling path in the dma-buf export feature that calls dma_buf_put() before dma_buf_export() succeeds, leading to unbalanced reference counts and memory corruption during file descriptor exhaustion scenarios. Exploitation probability remains very low (EPSS 0.02%, 5th percentile) with no public exploit code or evidence of active exploitation. Patches are available in stable kernel versions 6.19.11 and 7.0.

Technical ContextAI

The vulnerability exists in the VFIO (Virtual Function I/O) PCI core driver's dma-buf feature implementation, specifically in vfio_pci_core_feature_dma_buf(). VFIO provides direct device access to user-space applications and virtual machines, using dma-buf for GPU memory sharing. The Linux dma-buf framework requires strict reference counting discipline: dma_buf_put() must only be called after successful dma_buf_export(). The flawed error path violates this contract by unconditionally executing the entire cleanup chain even when export fails, causing premature object destruction. When file descriptor allocation fails (EMFILE/ENFILE conditions), this triggers use-after-free and double-free conditions on both the VFIO device reference and associated dma-buf objects. The bug affects mainline kernel code introduced at commit 5d74781ebc86c5fa9e9d6934024c505412de9b52 and fixed in commits 83ad334afc9a (6.19.11) and e98137f0a874 (7.0).

RemediationAI

Upgrade to Linux kernel version 6.19.11 or 7.0 or later, which contain the fixes for this double-free vulnerability (commits 83ad334afc9a and e98137f0a874 respectively). For distributions using long-term support kernels, apply vendor-provided backported patches when available through normal distribution update channels (apt, yum, dnf). If immediate patching is not feasible, disable VFIO PCI device assignment functionality by unloading the vfio-pci kernel module (modprobe -r vfio-pci) and blacklisting it in /etc/modprobe.d/blacklist.conf, though this breaks GPU passthrough and SR-IOV functionality for virtual machines and containers. Alternatively, implement resource limits via /etc/security/limits.conf to prevent file descriptor exhaustion (nofile hard limit), though this only reduces trigger likelihood and does not eliminate the vulnerability. Monitor kernel logs for segmentation faults in vfio-related processes as potential exploitation indicators. Full remediation requires kernel upgrade; compensating controls provide only partial risk reduction.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2023-25136 MEDIUM POC
6.5
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8
CVE-2017-6074 HIGH POC
7.8
CVE-2017-9287 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31468 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy