CVE-2026-31686
Double Free Vulnerability in Linux Kernel KASAN Page Table Handling
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19.0-rc1-00048-gea1013c15392 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a double free issue in the Linux kernel's memory management subsystem related to KASAN (Kernel Address Sanitizer). Specifically, the function kasan_free_pxd() incorrectly assumes that the page table is always aligned to a struct page, which is not true for all architectures such as powerpc with 64K page size. This misalignment can cause the same memory to be freed twice, leading to memory corruption.
The problem occurs because the PUD table (page upper directory) comes from a slab cache with a different alignment than expected. The fix involves passing the start of the pxd table directly instead of converting it via page_to_virt(), preventing the double free error.
How can this vulnerability impact me? :
This double free vulnerability can lead to memory corruption in the Linux kernel, which may cause system instability, crashes, or unpredictable behavior. In some cases, such memory corruption could be exploited by attackers to escalate privileges or execute arbitrary code within the kernel context, compromising system security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a double free error detected by KASAN (Kernel Address Sanitizer) in the Linux kernel. Detection typically involves monitoring kernel logs for KASAN error messages indicating double free issues related to kasan_remove_zero_shadow or kasan_free_pxd.
To detect this vulnerability on your system, you should check the kernel logs for KASAN reports. You can use commands such as:
- dmesg | grep -i kasan
- journalctl -k | grep -i kasan
- grep -i kasan /var/log/kern.log
These commands help identify if the kernel has reported any double free or memory corruption errors related to KASAN, which would indicate the presence of this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by correcting the handling of kasan_free_pxd() in the Linux kernel to avoid double free errors. Immediate mitigation involves updating your Linux kernel to a version that includes this fix.
Since this is a kernel-level issue, the recommended step is to apply the latest kernel patches or upgrade to a kernel version where this issue is resolved.
Additionally, monitoring kernel logs for KASAN errors and avoiding workloads that trigger this bug (such as those involving PMEM on affected architectures) until the patch is applied can help reduce risk.