PT-2026-35494 · Linux · Linux Kernel

Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-31688

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A race condition exists in the driver core due to inconsistent locking in the driver match device() function. While one call site holds the device lock(dev), others such as bind store and driver attach do not, meaning bus match() callbacks may be executed without the required lock. This inconsistency can lead to a use-after-free (UAF) condition, which is a situation where a program continues to use a pointer after it has been freed, specifically affecting buses that utilize the driver override implementation.

Recommendations Update the Linux Kernel to a version where driver match device locked() is implemented to enforce the device lock using a scoped guard in bind store() and driver attach().

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31688

Affected Products

Linux Kernel

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31688 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31688 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31688 · Security Note
• https://git.kernel.org/stable/c/dc23806a7c47ec5f1293aba407fb69519f976ee0 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31688 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31688 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31688 · Vendor Advisory
• https://twitter.com/vuldb/status/2049171335411282022 · Twitter Post
• https://git.kernel.org/linus/dc23806a7c47ec5f1293aba407fb69519f976ee0 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-31688 · Note
• https://twitter.com/vuldb/status/2048831335641526714 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048975800754422150 · Twitter Post
• https://twitter.com/CVEnew/status/2048852123010347094 · Twitter Post