{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-31442",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-03-09T15:48:24.090Z",
        "datePublished": "2026-04-22T13:53:39.895Z",
        "dateUpdated": "2026-08-05T12:22:34.443Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:22:34.443Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it's possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The vulnerable FLR recovery path is reached through local use of an Intel IDXD/DSA/IAA device, such as submitting descriptors through an enabled user work queue character device or otherwise causing the local PCI function to halt and reset.\nAC:L - A local attacker with access to an enabled work queue can repeatedly drive descriptor submission and memory pressure to make a second FLR hit the stale saved-state pointer path; there is no victim interaction or uncontrollable race required.\nPR:L - Triggering the path requires local authorization to use the configured IDXD work queue/device, but not real init-namespace root once the accelerator is exposed for user applications.\nUI:N - No separate victim action is needed after the attacker can access the local accelerator interface and trigger the reset sequence.\nS:U - The flaw corrupts or crashes the same host kernel/driver security authority; it is not a VM escape or IOMMU boundary bypass by itself.\nC:H - The stale `idxd->idxd_saved` pointer is a kernel use-after-free during reset restoration, and the freed object contains pointers and state later dereferenced by the driver, making high confidentiality impact defensible.\nI:H - The use-after-free can cause the driver to restore configuration from attacker-reclaimable freed memory and dereference/free stale subpointers, making kernel memory corruption and control-flow compromise plausible.\nA:H - Even without full exploitation, dereferencing the freed saved-state structure during FLR completion can cause an invalid memory access, oops, panic, or persistent device/kernel denial of service."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/dma/idxd/init.c"
                    ],
                    "versions": [
                        {
                            "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf",
                            "lessThan": "504c0e6751001ac46917c73e703f2b1b92cfc026",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf",
                            "lessThan": "867d0c801f21370d561420fa32f2ea1a7dc3a22d",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "98d187a989036096feaa2fef1ec3b2240ecdeacf",
                            "lessThan": "d6077df7b75d26e4edf98983836c05d00ebabd8d",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/dma/idxd/init.c"
                    ],
                    "versions": [
                        {
                            "version": "6.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.21",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.19.11",
                            "lessThanOrEqual": "6.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.18.21"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.19.11"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "7.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/504c0e6751001ac46917c73e703f2b1b92cfc026"
                },
                {
                    "url": "https://git.kernel.org/stable/c/867d0c801f21370d561420fa32f2ea1a7dc3a22d"
                },
                {
                    "url": "https://git.kernel.org/stable/c/d6077df7b75d26e4edf98983836c05d00ebabd8d"
                }
            ],
            "title": "dmaengine: idxd: Fix possible invalid memory access after FLR",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}