CVE-2026-31594 PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
A duplicate resource teardown in the Linux kernel PCI endpoint driver causes a use-after-free error, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31594?
CVE-2026-31594 is a medium-severity use after free vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to perform later. This leads to an oops when .allow_link fails or when .drop_link is performed. The following is an example oops of the former case:
Unable to handle kernel paging request at virtual address dead000000000108 [...] [dead000000000108] address between user and kernel address ranges Internal error: Oops: 0000000096000044 [#1] SMP [...] Call trace: pci_epc_remove_epf+0x78/0xe0 (P) pci_primary_epc_epf_link+0x88/0xa8 configfs_symlink+0x1f4/0x5a0 vfs_symlink+0x134/0x1d8 do_symlinkat+0x88/0x138 __arm64_sys_symlinkat+0x74/0xe0 [...]
Remove the helper, and drop pci_epc_put(). EPC device refcounting is tied to the configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient.
Which versions are affected by CVE-2026-31594?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31594?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31594 being exploited?
There is no known exploitation of CVE-2026-31594 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83777, BELL-CVE-2026-31594, DEBIAN-CVE-2026-31594, GHSA-9mvc-6grp-8hgm, ROOT-OS-DEBIAN-11-CVE-2026-31594, ROOT-OS-DEBIAN-12-CVE-2026-31594 and 4 more.