PT-2026-35008 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-03 · CVE-2026-31656

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free and refcount underflow can occur in the drm/i915/gt component. This happens when the heartbeat worker and the intel engine park heartbeat() function race to release the same engine->heartbeat.systole request. The heartbeat worker reads the pointer and calls i915 request put() but clears the pointer in a non-atomic step. Simultaneously, a request retirement on another CPU can trigger engine park() and subsequently intel engine park heartbeat(). If the heartbeat timer is pending, cancel delayed work() returns true, and intel engine park heartbeat() may read a stale non-NULL pointer and call i915 request put() again, leading to the refcount underflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-31656

ECHO-6123-CB74-10F7

Affected Products

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/455d98ed527fc94eed90406f90ab2391464ca657 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31656 · Vendor Advisory
• https://git.kernel.org/stable/c/8ce44d28a84fd5e053a88b04872a89d95c0779d4 · Patch
• https://git.kernel.org/stable/c/ca3f48c3567dd49efdc55b80029ae74659c682ee · Patch
• https://ubuntu.com/security/CVE-2026-31656 · Vendor Advisory
• https://git.kernel.org/stable/c/2af8b200cae3fdd0e917ecc2753b28bb40c876c1 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31656 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31656 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31656 · Security Note
• https://git.kernel.org/stable/c/a00e92bf6583d019a4fb2c2df7007e6c9b269ce7 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31656 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31656 · Security Note
• https://git.kernel.org/stable/c/70d3e622b10092fc483e28e57b4e8c49d9cc7f68 · Patch
• https://git.kernel.org/stable/c/4c71fd099513bfa8acab529b626e1f0097b76061 · Patch
• https://docs.bell-sw.com/security/cves/CVE-2026-31656 · Note