PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31436 Linux CVE debrief

A logic error in the Linux kernel's Intel Data Streaming Accelerator (IDXD) DMA engine driver can cause NULL pointer dereferences, double completion, or descriptor leaks during descriptor abort operations. The vulnerability exists in the `llist_abort_desc()` function where the traversal cursor `d` is used for iteration, but the wrong variable `found` is passed to the completion routine. This affects kernel versions 6.8 through 6.12.79, 6.13 through 6.18.20, 6.19 through 6.19.10, and 7.0 release candidates 1-6. The CVSS 3.1 score of 9.8 reflects network attack vector with low complexity and high impact to confidentiality, integrity, and availability. Patches are available from the stable kernel tree.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-05-19
Advisory published
2026-04-22
Advisory updated
2026-05-19

Who should care

Organizations running Linux kernels 6.8+ with Intel Data Streaming Accelerator (IDXD) hardware enabled; cloud providers offering bare-metal or virtualized instances with DSA/IDXD passthrough; HPC environments utilizing Intel DSA for memory operations; kernel maintainers and distribution vendors packaging IDXD driver support

Technical summary

The `llist_abort_desc()` function in `drivers/dma/idxd/` incorrectly completes the `found` descriptor instead of the traversal cursor `d` in its final cleanup loop. This logic error can trigger NULL pointer dereferences when `found` is NULL, cause double-completion if `found` points to an already-completed descriptor, or leak descriptors if the actual cursor `d` is never completed. The bug affects the Intel Data Streaming Accelerator (IDXD) driver's abort path, which is invoked during error handling or device teardown scenarios.

Defensive priority

critical

Recommended defensive actions

  • Apply kernel patches from stable branches: 6.12.80 or later, 6.18.21 or later, 6.19.11 or later, or 7.0-rc7 or later
  • Reboot systems after kernel update to ensure patched code is active
  • Verify IDXD driver is not loaded on unpatched systems if immediate patching is not feasible
  • Monitor kernel logs for NULL pointer dereference or descriptor-related errors in dmaengine_idxd
  • Review systems utilizing Intel Data Streaming Accelerator (IDXD) for DMA operations as priority patching targets

Evidence notes

Vulnerability description and patch references sourced from NVD. CWE-476 (NULL Pointer Dereference) assigned by NVD. Affected version ranges derived from CPE criteria in source data. CVSS vector confirms network-reachable attack surface with no privileges required.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31436 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31436

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31436 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31436

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0e4f43779d550e559be13a5cdb763bad92c4cc99

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/82656e8daf8de00935ae91b91bed43f4d6e0d644

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e1c9866173c5f8521f2d0768547a01508cb9ff27

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e21da2ad8844585040fe4b82be1ad2fe99d40074

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.