---
id: CVE-2026-31436
title: >-
  dmaengine: idxd: fix possible wrong descriptor completion in
  llist_abort_desc()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  dmaengine: idxd: fix possible wrong descriptor completion in
  llist_abort_desc()


  At the end of this function, d is the traversal cursor of flist, but the

  code completes…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 <
    e21da2ad8844585040fe4b82be1ad2fe99d40074
  - >-
    Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 <
    82656e8daf8de00935ae91b91bed43f4d6e0d644
  - >-
    Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 <
    0e4f43779d550e559be13a5cdb763bad92c4cc99
  - >-
    Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 <
    e1c9866173c5f8521f2d0768547a01508cb9ff27
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:09:16.062641Z'
published: '2026-04-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:10:00.102Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31436'
references:
  - url: 'https://git.kernel.org/stable/c/e21da2ad8844585040fe4b82be1ad2fe99d40074'
  - url: 'https://git.kernel.org/stable/c/82656e8daf8de00935ae91b91bed43f4d6e0d644'
  - url: 'https://git.kernel.org/stable/c/0e4f43779d550e559be13a5cdb763bad92c4cc99'
  - url: 'https://git.kernel.org/stable/c/e1c9866173c5f8521f2d0768547a01508cb9ff27'
tags:
  - cve.org
epss: 0.00671
epssPercentile: 0.51031
ingestedAt: '2026-10-16T17:24:46.651Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()

At the end of this function, d is the traversal cursor of flist, but the
code completes found instead. This can lead to issues such as NULL pointer
dereferences, double completion, or descriptor leaks.

Fix this by completing d instead of found in the final
list_for_each_entry_safe() loop.

## Affected

- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < e21da2ad8844585040fe4b82be1ad2fe99d40074`
- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < 82656e8daf8de00935ae91b91bed43f4d6e0d644`
- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < 0e4f43779d550e559be13a5cdb763bad92c4cc99`
- `Linux >= aa8d18becc0c14aa3eb46d6d1b81450446e11b87 < e1c9866173c5f8521f2d0768547a01508cb9ff27`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.