CVE-2026-31436
Description
A flaw was found in the Linux kernel's dmaengine subsystem, specifically within the idxd driver. This vulnerability occurs due to incorrect descriptor completion in the llist_abort_desc() function. This can lead to issues such as NULL pointer dereferences, double completion, or descriptor leaks, which can result in a denial of service.
Statement
This issue affects Intel Data Streaming Accelerator (idxd) descriptor abort handling in the upstream kernel. A mistaken completion target can destabilize the device path and crash or hang the system under error recovery. Red Hat tracks the CVE against supported products and will ship the upstream fix through kernel errata. Scope is limited to systems with idxd hardware and the driver loaded.
Mitigation
To mitigate this issue, prevent the idxd module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories
The program could read data from the wrong file.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Accessing a file descriptor that has been closed can cause a crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
