Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-31436

dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() At the end of this function, d is the traversal cursor of flist, but the code completes found instead. This can lead to issues such as NULL pointer dereferences, double completion, or descriptor leaks. Fix this by completing d instead of found in the final list_for_each_entry_safe() loop.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • aa8d18becc0c14aa3eb46d6d1b81450446e11b87 to < e21da2ad8844585040fe4b82be1ad2fe99d40074affected
  • aa8d18becc0c14aa3eb46d6d1b81450446e11b87 to < 82656e8daf8de00935ae91b91bed43f4d6e0d644affected
  • aa8d18becc0c14aa3eb46d6d1b81450446e11b87 to < 0e4f43779d550e559be13a5cdb763bad92c4cc99affected
  • aa8d18becc0c14aa3eb46d6d1b81450446e11b87 to < e1c9866173c5f8521f2d0768547a01508cb9ff27affected

Linux Linux

Default version status: affected

  • 6.8affected
  • 0 to < 6.8unaffected
  • 6.12.80 to ≤ 6.12.*unaffected
  • 6.18.21 to ≤ 6.18.*unaffected
  • 6.19.11 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References