CVE-2026-31644 (GCVE-0-2026-31644)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:44 – Updated: 2026-08-05 12:24
VLAI
Title
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() When lan966x_fdma_reload() fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can release pages back to the buddy allocator, the hardware may DMA into memory now owned by other kernel subsystems. Additionally, on the restore path, the newly created page pool (if allocation partially succeeded) is overwritten without being destroyed, leaking it. Fix both issues by deferring the release of old pages until after the new allocation succeeds. Save the old page array before the allocation so old pages can be freed on the success path. On the failure path, the old descriptors, pages and page pool are all still valid, making the restore safe. Also ensure the restore path re-enables NAPI and wakes the netdev, matching the success path.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 89ba464fcf548d64bc7215dfe769f791330ae8b6 , < 691082c0b93c13a5e068c0905f673060bddc204e (git)
Affected: 89ba464fcf548d64bc7215dfe769f791330ae8b6 , < 92a673019943770930e2a8bfd52e1aad47a1fc1f (git)
Affected: 89ba464fcf548d64bc7215dfe769f791330ae8b6 , < 9950e9199b3dfdfbde0b8d96ba947d7b11243801 (git)
Affected: 89ba464fcf548d64bc7215dfe769f791330ae8b6 , < 59c3d55a946cacdb4181600723c20ac4f4c20c84 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.82 , ≤ 6.12.* (semver)
Unaffected: 6.18.23 , ≤ 6.18.* (semver)
Unaffected: 6.19.13 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "691082c0b93c13a5e068c0905f673060bddc204e",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            },
            {
              "lessThan": "92a673019943770930e2a8bfd52e1aad47a1fc1f",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            },
            {
              "lessThan": "9950e9199b3dfdfbde0b8d96ba947d7b11243801",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            },
            {
              "lessThan": "59c3d55a946cacdb4181600723c20ac4f4c20c84",
              "status": "affected",
              "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable reload path is reached through local netdev administrative operations such as MTU changes or XDP setup via rtnetlink/sysfs, not by ordinary received packets alone. Network traffic can control subsequent DMA contents after the bad restore, but cannot independently invoke the reload path.\nAC:L - There is no attacker-uncontrolled race; an attacker with the needed local netdev access can repeatedly trigger reloads and influence memory pressure/traffic until allocation failure hits the vulnerable restore path. Under the required uncertainty rule, the allocation-failure condition is treated as low complexity.\nPR:L - The entry points require CAP_NET_ADMIN for the LAN966x netdev\u0027s owning network namespace, so privileges are required. In plausible delegated/containerized netns deployments this can be a low-privileged namespace capability rather than init-namespace root, so PR:L is the higher-severity defensible choice.\nUI:N - No victim action is required once the attacker has the required local netdev privileges. The attacker can perform the MTU/XDP operation and generate traffic directly.\nS:U - The corruption impacts kernel memory managed by the same host kernel/driver security authority. It is not a guest-to-host escape or a distinct IOMMU/security-scope crossing.\nC:H - This is a use-after-free of RX DMA pages where stale descriptors can cause hardware DMA into memory reallocated to other kernel subsystems. Such memory corruption is reasonably exploitable for kernel information disclosure.\nI:H - The stale DMA descriptors can write attacker-controlled received frame data into freed/reused kernel pages. That gives a high-integrity kernel memory corruption primitive.\nA:H - The bug can corrupt arbitrary kernel-owned memory or crash/hang the kernel, and the associated page-pool leak can worsen availability. Kernel memory corruption from a UAF warrants high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:06.448Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e"
        },
        {
          "url": "https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801"
        },
        {
          "url": "https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84"
        }
      ],
      "title": "net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31644",
    "datePublished": "2026-04-24T14:44:58.197Z",
    "dateReserved": "2026-03-09T15:48:24.127Z",
    "dateUpdated": "2026-08-05T12:24:06.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31644",
      "date": "2026-10-01",
      "epss": "0.0017",
      "percentile": "0.05717"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "691082c0b93c13a5e068c0905f673060bddc204e",
                    "status": "affected",
                    "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92a673019943770930e2a8bfd52e1aad47a1fc1f",
                    "status": "affected",
                    "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9950e9199b3dfdfbde0b8d96ba947d7b11243801",
                    "status": "affected",
                    "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "59c3d55a946cacdb4181600723c20ac4f4c20c84",
                    "status": "affected",
                    "version": "89ba464fcf548d64bc7215dfe769f791330ae8b6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.82",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36D94B3B-76E2-4F07-B407-336CB238EB63",
                    "versionEndExcluding": "6.12.82",
                    "versionStartIncluding": "6.12.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F",
                    "versionEndExcluding": "6.18.23",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4",
                    "versionEndExcluding": "6.19.13",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*",
                    "matchCriteriaId": "0E698080-7669-4132-8817-4C674EEBCE54",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path."
          }
        ],
        "id": "CVE-2026-31644",
        "lastModified": "2026-06-17T10:34:09.193",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-24T15:16:43.770",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:23:56+00:00",
      "cve": "CVE-2026-31644",
      "id": "CVE-2026-31644",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31644.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:23:59Z",
      "cve": "CVE-2026-31644",
      "id": "CVE-2026-31644",
      "initial_release_date": "2026-04-25T01:37:11Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "315",
      "product_status:recommended": "172",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31644",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31644.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.