Executive brief
A vulnerability in the Linux kernel's PCI endpoint driver could allow a local user to cause a system crash. The issue stems from how the system handles the removal of certain PCI hardware resources, leading to a 'kernel oops' or memory error. This primarily impacts system availability and could be used to disrupt operations on affected machines.
Technical details
A vulnerability in the pci-epf-vntb driver within the Linux kernel's PCI endpoint framework arises from duplicate resource teardown in the epf_ntb_epc_destroy() function. When .allow_link fails or .drop_link is executed, the driver attempts to release resources that are already scheduled for teardown by the caller, leading to a null pointer dereference or invalid memory access (kernel oops). The fix involves removing the redundant helper function and ensuring EPC device refcounting is correctly managed by the configfs EPC group lifetime. This is a local vulnerability that can be triggered by a user with sufficient privileges to manipulate PCI endpoint configurations.
Affected products
- Linux Linux Kernel 6.0 to 6.6.136, 6.7 to 6.12.84, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed: Initial disclosure of CVE-2026-31594
- 2026-04-24: advisory
- 2026-06-01: patched: Final patch enrichment completed in NVD
References
- https://git.kernel.org/stable/c/0da63230d3ec1ec5fcc443a2314233e95bfece54
- https://git.kernel.org/stable/c/305a0674bc552bfcc3231e23fb91cf4f62aec168
- https://git.kernel.org/stable/c/478e776101592eb63298714e96823ef78a3295ec
- https://git.kernel.org/stable/c/73bf218de28d039126dc64281d2b47dd3c46a0a3
- https://git.kernel.org/stable/c/a7a3cab4d33fd8a8aed864c447d0d7c99e85404e
- https://git.kernel.org/stable/c/b261027a1a235d8925e332363f23135a0eff2b35
- https://git.kernel.org/stable/c/cec9ead73ab154a7953f6ab8dd5127e0d6bbf95a