{"id":"CVE-2026-31436","revision":"d3051d86bd9844238245b6dba670a623","records":[{"revision":"d3051d86bd9844238245b6dba670a623","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31436","aliases":[],"title":"dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()\n\nAt the end of this function, d is the traversal cursor of flist, but the\ncode completes found instead. This can lead to issues such as NULL pointer\ndereferences, double completion, or descriptor leaks.\n\nFix this by completing d instead of found in the final\nlist_for_each_entry_safe() loop.","state":0,"publishedAt":"2026-04-22T13:53:35.693+00:00","modifiedAt":"2026-10-19T18:35:48.06+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/dma/idxd/submit.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"aa8d18becc0c14aa3eb46d6d1b81450446e11b87\",\n                            \"lessThan\": \"e21da2ad8844585040fe4b82be1ad2fe99d40074\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"aa8d18becc0c14aa3eb46d6d1b81450446e11b87\",\n                            \"lessThan\": \"82656e8daf8de00935ae91b91bed43f4d6e0d644\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"aa8d18becc0c14aa3eb46d6d1b81450446e11b87\",\n                            \"lessThan\": \"0e4f43779d550e559be13a5cdb763bad92c4cc99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"aa8d18becc0c14aa3eb46d6d1b81450446e11b87\",\n                            \"lessThan\": \"e1c9866173c5f8521f2d0768547a01508cb9ff27\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/dma/idxd/submit.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.80\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.21\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.11\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/e21da2ad8844585040fe4b82be1ad2fe99d40074","https://git.kernel.org/stable/c/82656e8daf8de00935ae91b91bed43f4d6e0d644","https://git.kernel.org/stable/c/0e4f43779d550e559be13a5cdb763bad92c4cc99","https://git.kernel.org/stable/c/e1c9866173c5f8521f2d0768547a01508cb9ff27"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31436","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31436","identifiers":["CVE-2026-31436"]},"retained":false,"historicalAffected":[]}],"coverage":[]}