Skip to main content

Linux Kernel CVE-2026-31645

| EUVDEUVD-2026-25538 MEDIUM
Memory Leak (CWE-401)
2026-04-24 Linux GHSA-xx6p-pxpq-h557
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to interact with lan966x hardware driver; impact is purely availability via kernel memory exhaustion, no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:49 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:19 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25538
CVE Published
Apr 24, 2026 - 14:44 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: fix page pool leak in error paths

lan966x_fdma_rx_alloc() creates a page pool but does not destroy it if the subsequent fdma_alloc_coherent() call fails, leaking the pool.

Similarly, lan966x_fdma_init() frees the coherent DMA memory when lan966x_fdma_tx_alloc() fails but does not destroy the page pool that was successfully created by lan966x_fdma_rx_alloc(), leaking it.

Add the missing page_pool_destroy() calls in both error paths.

AnalysisAI

Page pool memory leaks in the Linux kernel's lan966x FDMA (Flexible DMA) network driver cause resource exhaustion when DMA allocation failures occur during driver initialization, affecting systems built on Microchip lan966x Ethernet switch hardware. The missing page_pool_destroy() calls in two distinct error paths - inside lan966x_fdma_rx_alloc() and lan966x_fdma_init() - allow allocated pools to persist indefinitely if initialization fails, potentially degrading host availability. With an EPSS of 0.02% and no public exploit or KEV listing, this is a low-priority maintenance issue with real-world impact limited almost exclusively to embedded and industrial Linux deployments running this specific controller hardware.

Technical ContextAI

The lan966x is a Microchip Technology (formerly Microsemi) Ethernet switch-on-chip used in industrial embedded networking equipment. Its Linux driver implements an FDMA subsystem for efficient packet buffer management using the kernel's page_pool API, which provides a high-performance page allocation and recycling mechanism for network drivers. CWE-401 (Missing Release of Memory after Effective Lifetime) captures the root cause: two initialization functions - lan966x_fdma_rx_alloc() and lan966x_fdma_init() - fail to invoke page_pool_destroy() on their respective error exit paths, meaning the page pool object and its associated kernel memory remain allocated until the driver module is unloaded or the system is rebooted. The CPE coverage (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) reflects that any Linux kernel version incorporating the vulnerable FDMA initialization commit (11871aba19748b3387e83a2db6360aa7119e9a1a) prior to the four stable-branch fix commits is affected.

RemediationAI

Upgrade to Linux kernel 6.12.82, 6.18.23, 6.19.13, or 7.0, which include the fix adding page_pool_destroy() calls to both error paths in the lan966x FDMA driver. The four upstream fix commits are available at git.kernel.org: 73e940c4249dc5ec6422d1fae535d192fb125955, 22e1ee9f22b5c3bb702bb6d4167d770002a85b2b, 4941e234cfd67ac911fb259642b453f9f76aac41, and 076344a6ad9d1308faaed1402fdcfdda68b604ab. Ubuntu users should apply the patch via USN-8567-1 at https://ubuntu.com/security/notices/USN-8567-1. Red Hat and SUSE users should monitor their respective security advisories for backported fixes. If immediate patching is infeasible, periodically unloading and reloading the lan966x driver (if supported by the deployment) can reclaim leaked pools; alternatively, scheduling periodic reboots on affected embedded devices limits cumulative memory loss. Note that neither workaround eliminates the root cause.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31645 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy