Skip to main content

Linux Kernel CVE-2026-31686

| EUVDEUVD-2026-25882 HIGH
Double Free (CWE-415)
2026-04-27 Linux
Information Disclosure Linux IBM
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local privileged (root) access
  2. Delivery
    Target KASAN-enabled kernel on PowerPC 64K pages
  3. Exploit
    Unbind PMEM/nvdimm device via sysfs (ndctl)
  4. Execution
    Trigger kasan_remove_zero_shadow teardown
  5. Persist
    Double free of pgtable slab object
  6. Impact
    Slab corruption / kernel crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-415
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
Exploitation Conditions

Requires a kernel compiled with CONFIG_KASAN AND an architecture where page-table pages are not struct-page aligned (allocated from a slab cache), as demonstrated on PowerPC radix MMU with 64K page size where the PUD table comes from the pgtable-2^9 slab. The double free is reached specifically through the device-managed memory teardown path (memunmap_pages → kasan_remove_zero_shadow), triggered by unbinding/releasing a device that used devm_memremap_pages - the reproducer is an nvdimm/PMEM device unbound via ndctl through the sysfs unbind attribute, which is a root-only operation. Limiting factors: does not affect standard production kernels (KASAN is a debug-only build option), does not affect page-aligned page-table architectures (e.g. typical x86_64 4K-page configs), and requires local privileged access to the sysfs device-unbind interface - not remotely exploitable and not reachable in default distribution kernels.
Impact

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) overstates real-world risk for this specific defect. The bug is only reachable in kernels compiled with CONFIG_KASAN - a debugging/testing build that production distributions do not ship - and only on architectures with non-page-aligned page tables (the reproducer is PowerPC POWER10 with 64K pages and PMEM). Triggering it requires the privileged sysfs device-unbind path (writing to a driver's unbind attribute), which is root-only, so the input's PR:L likely understates the privilege requirement and its AC:L understates the architecture/config preconditions. All corroborating exploitation signals point to low priority: EPSS 0.02% (7th percentile), not in CISA KEV, and no POC. No SSVC record was provided. Net assessment: genuine memory-corruption bug worth patching in KASAN test/CI kernels, but not an operational priority for standard production fleets, which are not built with KASAN. The 'Information Disclosure' tag is not well supported by the description, which describes a double-free/corruption rather than a read primitive - treat that tag with caution.
Exploit ScenarioDerived

On a PowerPC system running a KASAN-enabled kernel with 64K pages and an nvdimm/PMEM device, a local administrator runs ndctl to unbind or disable the device; the driver-release path calls memunmap_pages() → kasan_remove_zero_shadow(), which frees the pgtable-2^9 slab object twice, corrupting slab metadata and destabilizing the kernel. No public exploit code has been identified, and reliable weaponization beyond a denial-of-service/crash would be difficult and highly build- and architecture-specific.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0.1, or mainline 7.1-rc1, or a distribution build incorporating the corresponding stable commits (apply your distro's update, e.g. per Ubuntu USN-8488-1 at https://ubuntu.com/security/notices/USN-8488-1). The upstream fix changes kasan_free_pxd() to free the actual start of the pXd table passed as the first argument instead of rounding to the enclosing page; see the kernel.org stable commits (e.g. https://git.kernel.org/stable/c/f6204f7ff6aff62ce6242a76982c5ba3a9ded707). If patching must be deferred, the practical compensating control is that the bug is only present in CONFIG_KASAN builds - building or running a non-KASAN production kernel eliminates exposure, at the cost of losing KASAN's memory-error detection in that image. As an additional interim control on affected KASAN builds, restrict who can unbind PMEM/nvdimm devices by limiting root/administrative access to the sysfs unbind interface and to ndctl operations, accepting that this only reduces the chance of triggering the teardown path rather than fixing the underlying double free.

Affected VersionsENISA

Linux 0207df4fa1a869281ddbf72db6203dbf036b3e1a <f6204f7ff6aff62ce6242a76982c5ba3a9ded707
Linux patch: 6.6.136
Linux 0207df4fa1a869281ddbf72db6203dbf036b3e1a <b38237a2ea9c6c19836eee2c57037e1f9f103576
Linux 0207df4fa1a869281ddbf72db6203dbf036b3e1a <a05f77cb227c39c5069aea6f12762a29d1e6c103
Linux 4.19
Linux patch: 7.1-rc1
Linux patch: 6.12.83
Linux patch: 6.19.14
Linux patch: 0
Linux patch: 6.18.24
Linux 0207df4fa1a869281ddbf72db6203dbf036b3e1a <85d98614e089a67dc6faa8ca766fe10a639f82b4
Linux patch: 7.0.1
Linux 0207df4fa1a869281ddbf72db6203dbf036b3e1a <cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87
Linux 0207df4fa1a869281ddbf72db6203dbf036b3e1a <51d8c78be0c27ddb91bc2c0263941d8b30a47d3b

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the kernel's KASAN (Kernel Address Sanitizer) subsystem, specifically kasan_free_pxd(), which frees per-level page-table pages (PGD/PUD/PMD/PTE, collectively 'pXd') when tearing down the KASAN zero-shadow region. The buggy code assumed every page-table allocation is struct-page aligned and used page_to_virt(pxd_page()) to compute the address to free. That assumption breaks on architectures where a page table is smaller than a page and comes from a slab cache rather than the page allocator: on PowerPC radix MMU with 64K base pages, the 4096-byte PUD table is served from the 'pgtable-2^9' kmem_cache. Rounding to the enclosing page yielded a pointer that was freed more than once, producing the CWE-415 (Double Free) condition reported by KASAN itself during kmem_cache_free()/check_slab_allocation(). CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.7 MEDIUM

Local, root-only sysfs unbind (PR:H); reachable only in KASAN builds on non-page-aligned-pagetable arches (AC:H); double free mainly yields corruption/DoS (A:H), with no clear confidentiality primitive (C:N).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 6.7 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
CVSS changed
May 06, 2026 - 21:07 NVD
7.8 (HIGH)
Patch available
Apr 27, 2026 - 19:01 EUVD
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVE Published
Apr 27, 2026 - 17:30 nvd
N/A
CVE Published
Apr 27, 2026 - 17:30 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

mm/kasan: fix double free for kasan pXds

kasan_free_pxd() assumes the page table is always struct page aligned. But that's not always the case for all architectures. E.g. In case of powerpc with 64K pagesize, PUD table (of size 4096) comes from slab cache named pgtable-2^9. Hence instead of page_to_virt(pxd_page()) let's just directly pass the start of the pxd table which is passed as the 1st argument.

This fixes the below double free kasan issue seen with PMEM:

radix-mmu: Mapped 0x0000047d10000000-0x0000047f90000000 with 2.00 MiB pages ============== BUG: KASAN: double-free in kasan_remove_zero_shadow+0x9c4/0xa20 Free of addr c0000003c38e0000 by task ndctl/2164

CPU: 34 UID: 0 PID: 2164 Comm: ndctl Not tainted 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARY Hardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries Call Trace: dump_stack_lvl+0x88/0xc4 (unreliable) print_report+0x214/0x63c kasan_report_invalid_free+0xe4/0x110 check_slab_allocation+0x100/0x150 kmem_cache_free+0x128/0x6e0 kasan_remove_zero_shadow+0x9c4/0xa20 memunmap_pages+0x2b8/0x5c0 devm_action_release+0x54/0x70 release_nodes+0xc8/0x1a0 devres_release_all+0xe0/0x140 device_unbind_cleanup+0x30/0x120 device_release_driver_internal+0x3e4/0x450 unbind_store+0xfc/0x110 drv_attr_store+0x78/0xb0 sysfs_kf_write+0x114/0x140 kernfs_fop_write_iter+0x264/0x3f0 vfs_write+0x3bc/0x7d0 ksys_write+0xa4/0x190 system_call_exception+0x190/0x480 system_call_vectored_common+0x15c/0x2ec ---- interrupt: 3000 at 0x7fff93b3d3f4 NIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000 REGS: c0000003f1b07e80 TRAP: 3000 Not tainted (6.19.0-rc1-00048-gea1013c15392) MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 48888208 XER: 00000000 <...> NIP [00007fff93b3d3f4] 0x7fff93b3d3f4 LR [00007fff93b3d3f4] 0x7fff93b3d3f4 ---- interrupt: 3000

The buggy address belongs to the object at c0000003c38e0000 which belongs to the cache pgtable-2^9 of size 4096 The buggy address is located 0 bytes inside of 4096-byte region [c0000003c38e0000, c0000003c38e1000)

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c38c head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:c0000003bfd63e01 flags: 0x63ffff800000040(head|node=6|zone=0|lastcpupid=0x7ffff) page_type: f5(slab) raw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01 head: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000 head: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01 head: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected

[ 138.953636] [ T2164] Memory state around the buggy address: [ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953661] [ T2164] >c0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953669] [ T2164] ^ [ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 138.953692] [ T2164] ============== [ 138.953701] [ T2164] Disabling lock debugging due to kernel taint

Executive ViewAI

Why It Matters

CVE-2026-31686 is a memory corruption vulnerability in Linux kernel debug builds with KASAN enabled, posing a local privilege escalation risk on affected systems. Most organizations face limited exposure as this defect is confined to specialized debug configurations not typically deployed in production environments. No active exploitation has been observed, but any systems running KASAN-enabled kernels require patching.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel runs almost everywhere, but only KASAN debug builds are vulnerable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://vuldb.com/vuln/359858 REF https://git.kernel.org/stable/c/2277246ea265cdca64ce6fdea4b26cd6ff0ec4db REF https://git.kernel.org/stable/c/3298bdf5a878ded06351eb293856fa84e050029e REF https://git.kernel.org/stable/c/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b REF https://git.kernel.org/stable/c/7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c REF https://git.kernel.org/stable/c/85d98614e089a67dc6faa8ca766fe10a639f82b4 REF https://git.kernel.org/stable/c/a05f77cb227c39c5069aea6f12762a29d1e6c103 REF https://git.kernel.org/stable/c/b38237a2ea9c6c19836eee2c57037e1f9f103576 REF https://git.kernel.org/stable/c/cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87 REF https://git.kernel.org/stable/c/f6204f7ff6aff62ce6242a76982c5ba3a9ded707

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy