Skip to main content

Linux Kernel CVE-2026-31492

| EUVDEUVD-2026-24862 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-w6p3-73r2-4574
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Apr 28, 2026 - 12:52 vuln.today
CVSS changed
Apr 28, 2026 - 12:52 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 12:46 nvd
Patch available
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24862
Analysis Generated
Apr 22, 2026 - 14:22 vuln.today
CVE Published
Apr 22, 2026 - 14:16 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Initialize free_qp completion before using it

In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp completion, which is not initialized yet. Fix this by initializing the completion before the ib_copy_to_udata call.

AnalysisAI

Use-after-free in Linux kernel RDMA/irdma driver allows local authenticated users to cause denial of service by triggering uninitialized completion handling during queue pair creation failure. When ib_copy_to_udata fails in irdma_create_qp, the cleanup path attempts to wait on an uninitialized free_qp completion structure, resulting in a kernel panic or system hang. EPSS score of 0.02% indicates low exploitation probability despite moderate CVSS score; patch is available from vendor.

Technical ContextAI

The vulnerability exists in the Intel RDMA Driver for Ethernet (irdma) kernel module, which implements Remote Direct Memory Access functionality. The issue is a completion synchronization bug in the queue pair creation flow. When irdma_create_qp invokes ib_copy_to_udata to transfer data to userspace and this operation fails, the error handler calls irdma_destroy_qp for cleanup. However, the free_qp completion structure has not yet been initialized via init_completion(), causing the subsequent wait_for_completion() call in the destroy path to operate on an uninitialized kernel object. This is classified as CWE-908 (Use of Uninitialized Resource), a memory safety issue. The vulnerability affects Linux kernel versions 5.14 through 7.0-rc4, as indicated by CPE strings and EUVD data.

RemediationAI

Apply vendor-released kernel patches: upgrade to Linux 6.1.168 or later (6.1.x branch), Linux 6.6.131 or later (6.6.x branch), Linux 6.12.80 or later (6.12.x branch), Linux 6.18.21 or later (6.18.x branch), Linux 6.19.11 or later (6.19.x branch), or Linux 7.0 stable release or later. The fix involves moving the init_completion(&iwqp->free_qp) call in irdma_create_qp to occur before the ib_copy_to_udata() call, ensuring the completion structure is properly initialized before any error path that calls irdma_destroy_qp. Refer to kernel git repository commits linked in NIST references for exact patch details. For systems unable to update immediately, disable RDMA/irdma functionality if not required, though this may impact performance on RoCE-enabled hardware. Monitor kernel logs for completion-related warnings or panics as potential indicators of exploitation attempts.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31492 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy