CVE-2026-31468 (GCVE-0-2026-31468)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-08-05 12:22
VLAI
Title
vfio/pci: Fix double free in dma-buf feature
Summary
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Fix double free in dma-buf feature The error path through vfio_pci_core_feature_dma_buf() ignores its own advice to only use dma_buf_put() after dma_buf_export(), instead falling through the entire unwind chain. In the unlikely event that we encounter file descriptor exhaustion, this can result in an unbalanced refcount on the vfio device and double free of allocated objects. Avoid this by moving the "put" directly into the error path and return the errno rather than entering the unwind chain.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5d74781ebc86c5fa9e9d6934024c505412de9b52 , < 83ad334afc9a645cef1062f5346526b1e36d6516 (git)
Affected: 5d74781ebc86c5fa9e9d6934024c505412de9b52 , < e98137f0a874ab36d0946de4707aa48cb7137d1c (git)
Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83ad334afc9a645cef1062f5346526b1e36d6516",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            },
            {
              "lessThan": "e98137f0a874ab36d0946de4707aa48cb7137d1c",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Fix double free in dma-buf feature\n\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\nown advice to only use dma_buf_put() after dma_buf_export(), instead\nfalling through the entire unwind chain.  In the unlikely event that\nwe encounter file descriptor exhaustion, this can result in an\nunbalanced refcount on the vfio device and double free of allocated\nobjects.\n\nAvoid this by moving the \"put\" directly into the error path and return\nthe errno rather than entering the unwind chain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through a local VFIO device file ioctl, specifically VFIO_DEVICE_FEATURE on a VFIO PCI device. It is not reachable from network packets, adjacent radio traffic, or physical hotplug alone.\nAC:L - Once a caller has an opened VFIO PCI device that supports the dma-buf feature, the failure path can be driven by attacker-controlled file descriptor exhaustion and valid ioctl inputs. The relevant condition is under the attacker\u0027s process control rather than a race or external timing dependency.\nPR:L - The attacker needs local access to an opened/access-granted VFIO device fd, which is normally delegated by device node permissions or virtualization management policy. The ioctl path itself does not require real init-namespace root for normal IOMMU-backed VFIO devices, and VFIO is not made reachable through unprivileged user namespaces.\nUI:N - No victim interaction is required after the attacker has the VFIO device fd. The attacker directly invokes the ioctl and controls the file descriptor exhaustion condition.\nS:U - The bug corrupts kernel/VFIO memory from a local kernel interface, so the vulnerable and impacted security authority is the same kernel instance. This is not a guest-to-host escape path or a direct IOMMU/DMA boundary bypass by itself.\nC:H - The old unwind path calls dma_buf_put(), whose release callback frees the private VFIO dma-buf object and phys_vec, then continues to dereference and free those same objects again. This double free/use-after-free style heap corruption is reasonably exploitable for kernel memory disclosure primitives.\nI:H - The double free of attacker-influenced kernel heap objects can corrupt allocator metadata or enable reuse of freed objects, which is a kernel memory corruption primitive. Under the required overestimation rule, this supports high integrity impact due to plausible arbitrary write or code execution.\nA:H - Even without full exploitation, the double free and unbalanced VFIO device reference can trigger allocator corruption, UAF, oops, or panic. The attacker can repeat the ioctl path to cause a reliable local denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:47.492Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516"
        },
        {
          "url": "https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c"
        }
      ],
      "title": "vfio/pci: Fix double free in dma-buf feature",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31468",
    "datePublished": "2026-04-22T13:53:57.583Z",
    "dateReserved": "2026-03-09T15:48:24.097Z",
    "dateUpdated": "2026-08-05T12:22:47.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31468",
      "date": "2026-08-15",
      "epss": "0.0012",
      "percentile": "0.02197"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31468\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-22T14:16:43.143\",\"lastModified\":\"2026-06-17T10:33:47.987\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvfio/pci: Fix double free in dma-buf feature\\n\\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\\nown advice to only use dma_buf_put() after dma_buf_export(), instead\\nfalling through the entire unwind chain.  In the unlikely event that\\nwe encounter file descriptor exhaustion, this can result in an\\nunbalanced refcount on the vfio device and double free of allocated\\nobjects.\\n\\nAvoid this by moving the \\\"put\\\" directly into the error path and return\\nthe errno rather than entering the unwind chain.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/vfio/pci/vfio_pci_dmabuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5d74781ebc86c5fa9e9d6934024c505412de9b52\",\"lessThan\":\"83ad334afc9a645cef1062f5346526b1e36d6516\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5d74781ebc86c5fa9e9d6934024c505412de9b52\",\"lessThan\":\"e98137f0a874ab36d0946de4707aa48cb7137d1c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/vfio/pci/vfio_pci_dmabuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.11\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.11\",\"matchCriteriaId\":\"4CA2E747-A9EC-4518-9AA2-B4247FC748B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:13:57+00:00",
      "cve": "CVE-2026-31468",
      "id": "CVE-2026-31468",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vfio/pci: Fix double free in dma-buf feature",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31468.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:25:02Z",
      "cve": "CVE-2026-31468",
      "id": "CVE-2026-31468",
      "initial_release_date": "2026-04-23T01:25:55Z",
      "product_status:known_not_affected": "301",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31468",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31468.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.