Skip to main content

Linux Kernel CVE-2026-31650

| EUVDEUVD-2026-25543 HIGH
Use After Free (CWE-416)
2026-04-24 Linux GHSA-f2r4-35m8-fgwm
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local, hardware-gated UAF triggered by winning a disconnect race, so AV:L and AC:H; low local privileges (PR:L) suffice and kernel heap corruption yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:47 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
7.8 (HIGH)
Patch released
Apr 27, 2026 - 20:14 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25543
CVE Published
Apr 24, 2026 - 14:45 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mmc: vub300: fix use-after-free on disconnect

The vub300 driver maintains an explicit reference count for the controller and its driver data and the last reference can in theory be dropped after the driver has been unbound.

This specifically means that the controller allocation must not be device managed as that can lead to use-after-free.

Note that the lifetime is currently also incorrectly tied the parent USB device rather than interface, which can lead to memory leaks if the driver is unbound without its device being physically disconnected (e.g. on probe deferral).

Fix both issues by reverting to non-managed allocation of the controller.

AnalysisAI

Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.

Technical ContextAI

The vub300 is a USB-attached SD/SDIO/MMC host-controller adapter; its Linux driver registers an mmc_host and maintains an explicit kref-style reference count for the controller and its private driver data. The bug is a classic CWE-416 use-after-free (source tags also flag memory corruption and information disclosure): the controller allocation used devm (device-managed) memory, which the kernel frees automatically at driver unbind, yet the driver's own reference count can hold a logical reference dropped later. When that final reference is released after the devm free, the code touches memory already returned to the allocator. A secondary defect ties object lifetime to the parent USB device rather than the USB interface, allowing a memory leak when the driver is unbound without a physical disconnect (e.g., probe deferral). The fix reverts the controller to non-managed allocation (explicit kmalloc/kfree bound to the driver's reference count).

RemediationAI

Upstream fix available (stable commits ea7468f6, ef0448c5, 8f4d20a7); apply the vendor-released patched kernel - update to Linux 6.18.23, 6.19.13, or later, or install the distribution kernel that backports these commits (track the Red Hat and SUSE advisories referenced in the source tags). If immediate patching is not possible, the practical compensating control is to prevent the vulnerable code path from loading: blacklist the vub300 module (add 'blacklist vub300' in /etc/modprobe.d/ and rebuild the initramfs) on hosts that do not use vub300 USB-to-SD/SDIO adapters, which fully removes the attack surface with no side effect where the hardware is absent; on hosts that rely on the adapter this would disable the device. Additionally restrict physical/USB access and local user privileges to reduce the chance of triggering the disconnect race. Reference advisories: https://nvd.nist.gov/vuln/detail/CVE-2026-31650 and the kernel.org stable commits above.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31650 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy