PT-2026-34406 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-28 · CVE-2026-31501

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the RX path of the icssg-prueth component. The function cppi5 hdesc get psdata() returns a pointer to the CPPI descriptor. In the functions emac rx packet() and emac rx packet zc(), the descriptor is released via k3 cppi desc pool free() before the psdata pointer is utilized by emac rx timestamp(), which dereferences psdata[0] and psdata[1].

Recommendations For the affected versions, ensure the descriptor is freed only after all accesses through the psdata pointer are complete. In emac rx packet(), move the free operation to the requeue label. In emac rx packet zc(), move the free operation to the end of the loop body after emac dispatch skb zc() has returned.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31501

Affected Products

Linux Kernel

References · 11

• https://ubuntu.com/security/CVE-2026-31501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31501 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31501 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31501 · Vendor Advisory
• https://git.kernel.org/stable/c/eb8c426c9803beb171f89d15fea17505eb517714 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31501 · Security Note
• https://git.kernel.org/stable/c/d5827316debcb677679bb014885d7be92c410e11 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31501 · Vendor Advisory
• https://t.me/cveNotify/161249 · Telegram Post
• https://twitter.com/CVEnew/status/2046979975123812421 · Twitter Post
• https://git.kernel.org/linus/eb8c426c9803beb171f89d15fea17505eb517714 · Note