{"id":"CVE-2026-31436","title":"dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()\n\nAt the end of this function, d is the traversal cursor of flist, but the\ncode completes…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < e21da2ad8844585040fe4b82be1ad2fe99d40074","Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < 82656e8daf8de00935ae91b91bed43f4d6e0d644","Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < 0e4f43779d550e559be13a5cdb763bad92c4cc99","Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < e1c9866173c5f8521f2d0768547a01508cb9ff27","Linux 6.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:09:16.062641Z"},"published":"2026-04-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:10:00.102Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31436","references":[{"url":"https://git.kernel.org/stable/c/e21da2ad8844585040fe4b82be1ad2fe99d40074"},{"url":"https://git.kernel.org/stable/c/82656e8daf8de00935ae91b91bed43f4d6e0d644"},{"url":"https://git.kernel.org/stable/c/0e4f43779d550e559be13a5cdb763bad92c4cc99"},{"url":"https://git.kernel.org/stable/c/e1c9866173c5f8521f2d0768547a01508cb9ff27"}],"tags":["cve.org"],"epss":0.00671,"epssPercentile":0.51031,"ingestedAt":"2026-10-16T17:24:46.651Z","slug":"CVE-2026-31436","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()\n\nAt the end of this function, d is the traversal cursor of flist, but the\ncode completes found instead. This can lead to issues such as NULL pointer\ndereferences, double completion, or descriptor leaks.\n\nFix this by completing d instead of found in the final\nlist_for_each_entry_safe() loop.\n\n## Affected\n\n- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < e21da2ad8844585040fe4b82be1ad2fe99d40074`\n- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < 82656e8daf8de00935ae91b91bed43f4d6e0d644`\n- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < 0e4f43779d550e559be13a5cdb763bad92c4cc99`\n- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < e1c9866173c5f8521f2d0768547a01508cb9ff27`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}