CVE-2026-31501 net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
A use-after-free in the TI ICSSG PRUETH driver allows attackers to cause denial of service or execute code via crafted network packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31501?
CVE-2026-31501 is a critical use after free vulnerability in Linux kernel, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path.
Defer the descriptor free until after all accesses through the psdata pointer are complete. For emac_rx_packet(), move the free into the requeue label so both early-exit and success paths free the descriptor after all accesses are done. For emac_rx_packet_zc(), move the free to the end of the loop body after emac_dispatch_skb_zc() (which calls emac_rx_timestamp()) has returned.
Weakness: CWE-416
Which versions are affected by CVE-2026-31501?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31501?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31501 being exploited?
There is no known exploitation of CVE-2026-31501 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31501, DEBIAN-CVE-2026-31501, GHSA-6xxj-984x-2f74, UBUNTU-CVE-2026-31501.