CVE-2026-31644 (GCVE-0-2026-31644)
Vulnerability from cvelistv5
Published
2026-04-24 14:44
Modified
2026-08-05 12:24
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() When lan966x_fdma_reload() fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can release pages back to the buddy allocator, the hardware may DMA into memory now owned by other kernel subsystems. Additionally, on the restore path, the newly created page pool (if allocation partially succeeded) is overwritten without being destroyed, leaking it. Fix both issues by deferring the release of old pages until after the new allocation succeeds. Save the old page array before the allocation so old pages can be freed on the success path. On the failure path, the old descriptors, pages and page pool are all still valid, making the restore safe. Also ensure the restore path re-enables NAPI and wakes the netdev, matching the success path.
References
Impacted products
Vendor Product Version
Linux Linux Version: 89ba464fcf548d64bc7215dfe769f791330ae8b6
Version: 89ba464fcf548d64bc7215dfe769f791330ae8b6
Version: 89ba464fcf548d64bc7215dfe769f791330ae8b6
Version: 89ba464fcf548d64bc7215dfe769f791330ae8b6
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "691082c0b93c13a5e068c0905f673060bddc204e",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            },
            {
              "lessThan": "92a673019943770930e2a8bfd52e1aad47a1fc1f",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            },
            {
              "lessThan": "9950e9199b3dfdfbde0b8d96ba947d7b11243801",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            },
            {
              "lessThan": "59c3d55a946cacdb4181600723c20ac4f4c20c84",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable reload path is reached through local netdev administrative operations such as MTU changes or XDP setup via rtnetlink/sysfs, not by ordinary received packets alone. Network traffic can control subsequent DMA contents after the bad restore, but cannot independently invoke the reload path.\nAC:L - There is no attacker-uncontrolled race; an attacker with the needed local netdev access can repeatedly trigger reloads and influence memory pressure/traffic until allocation failure hits the vulnerable restore path. Under the required uncertainty rule, the allocation-failure condition is treated as low complexity.\nPR:L - The entry points require CAP_NET_ADMIN for the LAN966x netdev\u0027s owning network namespace, so privileges are required. In plausible delegated/containerized netns deployments this can be a low-privileged namespace capability rather than init-namespace root, so PR:L is the higher-severity defensible choice.\nUI:N - No victim action is required once the attacker has the required local netdev privileges. The attacker can perform the MTU/XDP operation and generate traffic directly.\nS:U - The corruption impacts kernel memory managed by the same host kernel/driver security authority. It is not a guest-to-host escape or a distinct IOMMU/security-scope crossing.\nC:H - This is a use-after-free of RX DMA pages where stale descriptors can cause hardware DMA into memory reallocated to other kernel subsystems. Such memory corruption is reasonably exploitable for kernel information disclosure.\nI:H - The stale DMA descriptors can write attacker-controlled received frame data into freed/reused kernel pages. That gives a high-integrity kernel memory corruption primitive.\nA:H - The bug can corrupt arbitrary kernel-owned memory or crash/hang the kernel, and the associated page-pool leak can worsen availability. Kernel memory corruption from a UAF warrants high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:06.448Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e"
        },
        {
          "url": "https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801"
        },
        {
          "url": "https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84"
        }
      ],
      "title": "net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31644",
    "datePublished": "2026-04-24T14:44:58.197Z",
    "dateReserved": "2026-03-09T15:48:24.127Z",
    "dateUpdated": "2026-08-05T12:24:06.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.