PT-2026-34996 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-03 · CVE-2026-31644

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free and memory leak issue exists in the lan966x fdma reload() function. When the function fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x fdma rx free pages(). Because page pool put full page() can release pages back to the buddy allocator, the hardware may perform DMA into memory owned by other kernel subsystems. Additionally, if allocation partially succeeds, the newly created page pool is overwritten without being destroyed, resulting in a memory leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31644

Affected Products

Linux Kernel

References · 15

• https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f · Patch
• https://ubuntu.com/security/CVE-2026-31644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31644 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31644 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31644 · Vendor Advisory
• https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84 · Patch
• https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31644 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31644 · Security Note
• https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31644 · Vendor Advisory
• https://twitter.com/CVEnew/status/2047731938354418026 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2047787661159506210 · Twitter Post
• https://git.kernel.org/linus/59c3d55a946cacdb4181600723c20ac4f4c20c84 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-31644 · Note