Junglewise Threat Intelligence

CVE-2026-31399: Linux Kernel use after free in nvdimm/bus asynchronous initialization

CVE-2026-31399 · Severity: high · CVSS 7.8 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's NVDIMM (Non-Volatile Dual In-line Memory Module) bus driver. This component manages persistent memory devices used for high-speed data storage. An exploit could allow a local attacker to cause a system crash or potentially execute unauthorized code, impacting system stability and data integrity.

Technical details

A use-after-free (UAF) vulnerability exists in the nd_async_device_register() function within drivers/nvdimm/bus.c. The issue occurs when device_add() fails (e.g., due to memory allocation failure), causing the device's reference count to drop to zero. Subsequently, the code attempts to access the device's parent pointer to release its reference, leading to a UAF. The fix involves caching the parent pointer before calling device_add() to ensure the reference can be safely dropped regardless of the registration outcome. This is a local vulnerability requiring low privileges to trigger.

Affected products

  • Linux Linux Kernel 4.4.164 to 4.5; 4.9.137 to 4.10; 4.14.81 to 4.15; 4.18.19 to 4.19; 4.19.2 to 5.10.253; 5.11 to 5.15.203; 5.16 to 6.1.167; 6.2 to 6.6.130; 6.7 to 6.12.78; 6.13 to 6.18.20; 6.19 to 6.19.10; 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-06: patched: Initial patch authored by Ira Weiny
  • 2026-04-03: disclosed: CVE published

References