PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31436 Linux CVE debrief

A logic error in the Linux kernel's Intel Data Streaming Accelerator (IDXD) DMA engine driver can cause NULL pointer dereferences, double completion, or descriptor leaks during descriptor abort operations. The vulnerability exists in the `llist_abort_desc()` function where the traversal cursor `d` is used for iteration, but the wrong variable `found` is passed to the completion routine. This affects kernel versions 6.8 through 6.12.79, 6.13 through 6.18.20, 6.19 through 6.19.10, and 7.0 release candidates 1-6. The CVSS 3.1 score of 9.8 reflects network attack vector with low complexity and high impact to confidentiality, integrity, and availability. Patches are available from the stable kernel tree.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-05-19
Advisory published
2026-04-22
Advisory updated
2026-05-19

Who should care

Organizations running Linux kernels 6.8+ with Intel Data Streaming Accelerator (IDXD) hardware enabled; cloud providers offering bare-metal or virtualized instances with DSA/IDXD passthrough; HPC environments utilizing Intel DSA for memory operations; kernel maintainers and distribution vendors packaging IDXD driver support

Technical summary

The `llist_abort_desc()` function in `drivers/dma/idxd/` incorrectly completes the `found` descriptor instead of the traversal cursor `d` in its final cleanup loop. This logic error can trigger NULL pointer dereferences when `found` is NULL, cause double-completion if `found` points to an already-completed descriptor, or leak descriptors if the actual cursor `d` is never completed. The bug affects the Intel Data Streaming Accelerator (IDXD) driver's abort path, which is invoked during error handling or device teardown scenarios.

Defensive priority

critical

Recommended defensive actions

  • Apply kernel patches from stable branches: 6.12.80 or later, 6.18.21 or later, 6.19.11 or later, or 7.0-rc7 or later
  • Reboot systems after kernel update to ensure patched code is active
  • Verify IDXD driver is not loaded on unpatched systems if immediate patching is not feasible
  • Monitor kernel logs for NULL pointer dereference or descriptor-related errors in dmaengine_idxd
  • Review systems utilizing Intel Data Streaming Accelerator (IDXD) for DMA operations as priority patching targets

Evidence notes

Vulnerability description and patch references sourced from NVD. CWE-476 (NULL Pointer Dereference) assigned by NVD. Affected version ranges derived from CPE criteria in source data. CVSS vector confirms network-reachable attack surface with no privileges required.

Official resources

2026-04-22