Skip to main content

Linux Kernel CVE-2026-31686

| EUVDEUVD-2026-25882 HIGH
Double Free (CWE-415)
2026-04-27 Linux
Information Disclosure Linux IBM
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Local, root-only sysfs unbind (PR:H); reachable only in KASAN builds on non-page-aligned-pagetable arches (AC:H); double free mainly yields corruption/DoS (A:H), with no clear confidentiality primitive (C:N).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.7 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 05:07 vuln.today
CVSS changed
May 06, 2026 - 21:07 NVD
7.8 (HIGH)
Patch available
Apr 27, 2026 - 19:01 EUVD
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
EUVD ID Assigned
Apr 27, 2026 - 18:00 euvd
EUVD-2026-25882
CVE Published
Apr 27, 2026 - 17:30 nvd
N/A
CVE Published
Apr 27, 2026 - 17:30 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm/kasan: fix double free for kasan pXds

kasan_free_pxd() assumes the page table is always struct page aligned. But that's not always the case for all architectures. E.g. In case of powerpc with 64K pagesize, PUD table (of size 4096) comes from slab cache named pgtable-2^9. Hence instead of page_to_virt(pxd_page()) let's just directly pass the start of the pxd table which is passed as the 1st argument.

This fixes the below double free kasan issue seen with PMEM:

radix-mmu: Mapped 0x0000047d10000000-0x0000047f90000000 with 2.00 MiB pages ============== BUG: KASAN: double-free in kasan_remove_zero_shadow+0x9c4/0xa20 Free of addr c0000003c38e0000 by task ndctl/2164

CPU: 34 UID: 0 PID: 2164 Comm: ndctl Not tainted 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARY Hardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries Call Trace: dump_stack_lvl+0x88/0xc4 (unreliable) print_report+0x214/0x63c kasan_report_invalid_free+0xe4/0x110 check_slab_allocation+0x100/0x150 kmem_cache_free+0x128/0x6e0 kasan_remove_zero_shadow+0x9c4/0xa20 memunmap_pages+0x2b8/0x5c0 devm_action_release+0x54/0x70 release_nodes+0xc8/0x1a0 devres_release_all+0xe0/0x140 device_unbind_cleanup+0x30/0x120 device_release_driver_internal+0x3e4/0x450 unbind_store+0xfc/0x110 drv_attr_store+0x78/0xb0 sysfs_kf_write+0x114/0x140 kernfs_fop_write_iter+0x264/0x3f0 vfs_write+0x3bc/0x7d0 ksys_write+0xa4/0x190 system_call_exception+0x190/0x480 system_call_vectored_common+0x15c/0x2ec ---- interrupt: 3000 at 0x7fff93b3d3f4 NIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000 REGS: c0000003f1b07e80 TRAP: 3000 Not tainted (6.19.0-rc1-00048-gea1013c15392) MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 48888208 XER: 00000000 <...> NIP [00007fff93b3d3f4] 0x7fff93b3d3f4 LR [00007fff93b3d3f4] 0x7fff93b3d3f4 ---- interrupt: 3000

The buggy address belongs to the object at c0000003c38e0000 which belongs to the cache pgtable-2^9 of size 4096 The buggy address is located 0 bytes inside of 4096-byte region [c0000003c38e0000, c0000003c38e1000)

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c38c head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:c0000003bfd63e01 flags: 0x63ffff800000040(head|node=6|zone=0|lastcpupid=0x7ffff) page_type: f5(slab) raw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01 head: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000 head: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01 head: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected

[ 138.953636] [ T2164] Memory state around the buggy address: [ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953661] [ T2164] >c0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953669] [ T2164] ^ [ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953692] [ T2164] ============== [ 138.953701] [ T2164] Disabling lock debugging due to kernel taint

AnalysisAI

Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.

Technical ContextAI

The flaw lives in the kernel's KASAN (Kernel Address Sanitizer) subsystem, specifically kasan_free_pxd(), which frees per-level page-table pages (PGD/PUD/PMD/PTE, collectively 'pXd') when tearing down the KASAN zero-shadow region. The buggy code assumed every page-table allocation is struct-page aligned and used page_to_virt(pxd_page()) to compute the address to free. That assumption breaks on architectures where a page table is smaller than a page and comes from a slab cache rather than the page allocator: on PowerPC radix MMU with 64K base pages, the 4096-byte PUD table is served from the 'pgtable-2^9' kmem_cache. Rounding to the enclosing page yielded a pointer that was freed more than once, producing the CWE-415 (Double Free) condition reported by KASAN itself during kmem_cache_free()/check_slab_allocation(). CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0.1, or mainline 7.1-rc1, or a distribution build incorporating the corresponding stable commits (apply your distro's update, e.g. per Ubuntu USN-8488-1 at https://ubuntu.com/security/notices/USN-8488-1). The upstream fix changes kasan_free_pxd() to free the actual start of the pXd table passed as the first argument instead of rounding to the enclosing page; see the kernel.org stable commits (e.g. https://git.kernel.org/stable/c/f6204f7ff6aff62ce6242a76982c5ba3a9ded707). If patching must be deferred, the practical compensating control is that the bug is only present in CONFIG_KASAN builds - building or running a non-KASAN production kernel eliminates exposure, at the cost of losing KASAN's memory-error detection in that image. As an additional interim control on affected KASAN builds, restrict who can unbind PMEM/nvdimm devices by limiting root/administrative access to the sysfs unbind interface and to ndctl operations, accepting that this only reduces the chance of triggering the teardown path rather than fixing the underlying double free.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-31686 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy