Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-31644— net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

CVSS 7.8 · High EPSS 0.12% · P3

Possible ATT&CK Techniques 1AI

T1499.002 · Service Exhaustion Flood

Affected Version Matrix 10

VendorProductVersion RangeStatus
LinuxLinux89ba464fcf548d64bc7215dfe769f791330ae8b6< 691082c0b93c13a5e068c0905f673060bddc204eaffected
89ba464fcf548d64bc7215dfe769f791330ae8b6< 92a673019943770930e2a8bfd52e1aad47a1fc1faffected
89ba464fcf548d64bc7215dfe769f791330ae8b6< 9950e9199b3dfdfbde0b8d96ba947d7b11243801affected
89ba464fcf548d64bc7215dfe769f791330ae8b6< 59c3d55a946cacdb4181600723c20ac4f4c20c84affected
6.12affected
< 6.12unaffected
6.12.82≤ 6.12.*unaffected
6.18.23≤ 6.18.*unaffected
… +2 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-31644

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() When lan966x_fdma_reload() fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can release pages back to the buddy allocator, the hardware may DMA into memory now owned by other kernel subsystems. Additionally, on the restore path, the newly created page pool (if allocation partially succeeded) is overwritten without being destroyed, leaking it. Fix both issues by deferring the release of old pages until after the new allocation succeeds. Save the old page array before the allocation so old pages can be freed on the success path. On the failure path, the old descriptors, pages and page pool are all still valid, making the restore safe. Also ensure the restore path re-enables NAPI and wakes the netdev, matching the success path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于lan966x_fdma_reload函数在分配新RX缓冲区失败时，恢复路径使用已释放页面的旧描述符，可能导致释放后重用和内存泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 89ba464fcf548d64bc7215dfe769f791330ae8b6 ~ 691082c0b93c13a5e068c0905f673060bddc204e -
LinuxLinux 6.12 -

II. Public POCs for CVE-2026-31644

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31644

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-24 · 138 CVEs total

CVE-2026-316339.8 CRITICALrxrpc: Fix integer overflow in rxgk_verify_response()
CVE-2026-315899.8 CRITICALmm: call ->free_folio() directly in folio_unmap_invalidate()
CVE-2026-316379.8 CRITICALrxrpc: reject undecryptable rxkad response tickets
CVE-2026-316699.8 CRITICALmptcp: fix slab-use-after-free in __inet_lookup_established
CVE-2026-316689.8 CRITICALseg6: separate dst_cache for input and output paths in seg6 lwtunnel
CVE-2026-315369.8 CRITICALsmb: server: let send_done handle a completion without IB_SEND_SIGNALED
CVE-2026-316499.8 CRITICALnet: stmmac: fix integer underflow in chain mode
CVE-2026-316079.8 CRITICALusbip: validate number_of_packets in usbip_pack_ret_submit()
CVE-2026-316089.8 CRITICALsmb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list
CVE-2026-316099.8 CRITICALsmb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
CVE-2026-316579.8 CRITICALbatman-adv: hold claim backbone gateways by reference
CVE-2026-316599.8 CRITICALbatman-adv: reject oversized global TT response buffers
CVE-2026-316369.1 CRITICALrxrpc: fix RESPONSE authenticator parser OOB read
CVE-2026-316298.8 HIGHnfc: llcp: add missing return after LLCP_CLOSED checks
CVE-2026-315888.8 HIGHKVM: x86: Use scratch field in MMIO fragment to hold small write values
CVE-2026-315708.8 HIGHcan: gw: fix OOB heap access in cgw_csum_crc8_rel()
CVE-2026-316228.8 HIGHNFC: digital: Bounds check NFC-A cascade depth in SDD response handler
CVE-2026-315588.8 HIGHLoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
CVE-2026-315538.8 HIGHKVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
CVE-2026-316118.6 HIGHksmbd: require 3 sub-authorities before reading sub_auth[2]

Showing top 20 of 138 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31644

No comments yet

Leave a comment