Junglewise Threat Intelligence

CVE-2026-31441: Linux Kernel memory leak in idxd dmaengine workqueue reset

CVE-2026-31441 · Severity: medium · CVSS 5.5 · Published 2026-04-22

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A memory leak vulnerability exists in the Linux kernel's Intel Data Streaming Accelerator (IDXD) driver. When a workqueue—a mechanism used to manage background tasks—is reset, the system may fail to properly release allocated memory. Over time, this can lead to memory exhaustion, potentially causing system instability or a denial-of-service condition where the device becomes unresponsive.

Technical details

A memory leak exists in the dmaengine idxd driver within the Linux kernel. The function idxd_wq_disable_cleanup(), which is triggered during a workqueue reset, incorrectly sets the workqueue type to 'NONE' before its associated resources are fully released. Because other parts of the driver interpret the 'NONE' type as an indication that the workqueue is already empty and its resources freed, the actual cleanup routines are bypassed. This results in a leak of descriptors and coherent DMA memory. An attacker with local access could potentially trigger repeated resets to exhaust system memory, leading to a denial-of-service. The fix involves reordering the operations to ensure the workqueue type is only set to 'NONE' after idxd_wq_free_resources() has completed.

Affected products

  • Linux Linux Kernel da32b28c95a7 to a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-04-22: advisory: Initial NVD publication date
  • 2026-04-02: patched: Fix committed to various stable kernel branches

References

Related threats