{"id":"CVE-2026-31645","title":"net: lan966x: fix page pool leak in error paths","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix page pool leak in error paths\n\nlan966x_fdma_rx_alloc() creates a page pool but does not destroy it if\nthe subsequent fdma_alloc_coherent() call fails,…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < a229a4dc87302fa131f3394b09b0efd8c255a5ac","Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 73e940c4249dc5ec6422d1fae535d192fb125955","Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 22e1ee9f22b5c3bb702bb6d4167d770002a85b2b","Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 4941e234cfd67ac911fb259642b453f9f76aac41","Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 076344a6ad9d1308faaed1402fdcfdda68b604ab","Linux 6.2"],"published":"2026-04-24","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:39:37.535Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31645","references":[{"url":"https://git.kernel.org/stable/c/a229a4dc87302fa131f3394b09b0efd8c255a5ac"},{"url":"https://git.kernel.org/stable/c/73e940c4249dc5ec6422d1fae535d192fb125955"},{"url":"https://git.kernel.org/stable/c/22e1ee9f22b5c3bb702bb6d4167d770002a85b2b"},{"url":"https://git.kernel.org/stable/c/4941e234cfd67ac911fb259642b453f9f76aac41"},{"url":"https://git.kernel.org/stable/c/076344a6ad9d1308faaed1402fdcfdda68b604ab"}],"tags":["cve.org"],"epss":0.00162,"epssPercentile":0.04996,"ingestedAt":"2026-10-21T12:48:53.661Z","slug":"CVE-2026-31645","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix page pool leak in error paths\n\nlan966x_fdma_rx_alloc() creates a page pool but does not destroy it if\nthe subsequent fdma_alloc_coherent() call fails, leaking the pool.\n\nSimilarly, lan966x_fdma_init() frees the coherent DMA memory when\nlan966x_fdma_tx_alloc() fails but does not destroy the page pool that\nwas successfully created by lan966x_fdma_rx_alloc(), leaking it.\n\nAdd the missing page_pool_destroy() calls in both error paths.\n\n## Affected\n\n- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < a229a4dc87302fa131f3394b09b0efd8c255a5ac`\n- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 73e940c4249dc5ec6422d1fae535d192fb125955`\n- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 22e1ee9f22b5c3bb702bb6d4167d770002a85b2b`\n- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 4941e234cfd67ac911fb259642b453f9f76aac41`\n- `Linux >= 11871aba19748b3387e83a2db6360aa7119e9a1a < 076344a6ad9d1308faaed1402fdcfdda68b604ab`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}