CVE-2026-31468
Double Free Vulnerability in Linux vfio/pci dma-buf Feature
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's vfio/pci component, specifically related to the dma-buf feature. The issue is a double free error caused by an improper error handling path in the function vfio_pci_core_feature_dma_buf(). The function incorrectly ignores its own guideline to only call dma_buf_put() after dma_buf_export(), leading to an unbalanced reference count on the vfio device and a double free of allocated objects when file descriptor exhaustion occurs.
The fix involves moving the dma_buf_put() call directly into the error path and returning the error number immediately, preventing the function from continuing through the unwind chain and causing the double free.
How can this vulnerability impact me? :
This vulnerability can lead to a double free of allocated objects within the Linux kernel's vfio device handling. Such a double free can cause memory corruption, which may result in system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update your Linux kernel to a version where the vfio/pci double free issue in the dma-buf feature has been fixed.
The fix involves correcting the error path in vfio_pci_core_feature_dma_buf() to avoid double freeing by properly handling dma_buf_put() calls and returning errors without entering the unwind chain.
Applying the latest kernel patches or upgrading to the latest stable kernel release that includes this fix is the recommended immediate step.