CVE-2026-31399
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: nvdimm/bus: Fix potential use after free in asynchronous initialization Dingisoul with KASAN reports a use after free if device_add() fails in nd_async_device_register(). Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") correctly added a reference on the parent device to be held until asynchronous initialization was complete. However, if device_add() results in an allocation failure the ref count of the device drops to 0 prior to the parent pointer being accessed. Thus resulting in use after free. The bug bot AI correctly identified the fix. Save a reference to the parent pointer to be used to drop the parent reference regardless of the outcome of device_add().
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-04-03 16:16:38.410000
Last modified
2026-11-05 22:18:28.600000
View original CVE JSON
{
"id": "CVE-2026-31399",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-04-03T16:16:38.410",
"lastModified": "2026-11-05T22:18:28.600",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\"libnvdimm: Hold reference on parent while\nscheduling async init\") correctly added a reference on the parent device\nto be held until asynchronous initialization was complete. However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed. Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix. Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add()."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvdimm/bus: Soluciona un posible uso después de liberar en la inicialización asíncrona\n\nDingisoul con KASAN informa de un uso después de liberar si device_add() falla en nd_async_device_register().\n\nEl commit b6eae0f61db2 ('libnvdimm: Mantener referencia en el padre mientras se programa la inicialización asíncrona') añadió correctamente una referencia en el dispositivo padre para ser mantenida hasta que la inicialización asíncrona estuviera completa. Sin embargo, si device_add() resulta en un fallo de asignación, el contador de referencias del dispositivo cae a 0 antes de que se acceda al puntero padre. Resultando así en un uso después de liberar.\n\nLa IA del bot de errores identificó correctamente la solución. Guarda una referencia al puntero padre para ser utilizada para liberar la referencia padre independientemente del resultado de device_add()."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/nvdimm/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "6fc36c2a925ceaba203eb13d75a8f0879a2c121b",
"versionType": "git",
"status": "affected"
},
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "a36cf138500e56f50db9f9a33222df6969b38326",
"versionType": "git",
"status": "affected"
},
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d",
"versionType": "git",
"status": "affected"
},
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e",
"versionType": "git",
"status": "affected"
},
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "2c638259ad750833fd46a0cf57672a618542d84c",
"versionType": "git",
"status": "affected"
},
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "a226e5b49e5fe8c98b14f8507de670189d191348",
"versionType": "git",
"status": "affected"
},
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "84af19855d1abdee3c9d57c0684e2868e391793c",
"versionType": "git",
"status": "affected"
},
{
"version": "b6eae0f61db27748606cc00dafcfd1e2c032f0a5",
"lessThan": "a8aec14230322ed8f1e8042b6d656c1631d41163",
"versionType": "git",
"status": "affected"
},
{
"version": "8954771abdea5c34280870e35592c7226a816d95",
"versionType": "git",
"status": "affected"
},
{
"version": "3e63a7f25cc85d3d3e174b9b0e3489ebb7eaf4ab",
"versionType": "git",
"status": "affected"
},
{
"version": "1490de2bb0836fc0631c04d0559fdf81545b672f",
"versionType": "git",
"status": "affected"
},
{
"version": "e31a8418c8df7e6771414f99ed3d95ba8aca4e05",
"versionType": "git",
"status": "affected"
},
{
"version": "4f1a55a4f990016406147cf3e0c9487bf83e50f0",
"versionType": "git",
"status": "affected"
},
{
"version": "4.4.164",
"lessThan": "4.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.9.137",
"lessThan": "4.10",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.14.81",
"lessThan": "4.15",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.18.19",
"lessThan": "4.19",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.19.2",
"lessThan": "4.20",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/nvdimm/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.20",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.20",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.253",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.203",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.167",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.130",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.78",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.20",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.10",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T21:32:10.448630Z",
"id": "CVE-2026-31399",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.164",
"versionEndExcluding": "4.5",
"matchCriteriaId": "3F465C16-7558-45C0-8A57-E91446282ED2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.137",
"versionEndExcluding": "4.10",
"matchCriteriaId": "37605FCB-BF78-48D6-8838-00E69121C271"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.81",
"versionEndExcluding": "4.15",
"matchCriteriaId": "0E3D2C10-16F9-4F31-94C6-EBE99C89FF70"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.18.19",
"versionEndExcluding": "4.19",
"matchCriteriaId": "9D418973-A1B7-4F79-B990-AFFA8B41983C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.2",
"versionEndExcluding": "5.10.253",
"matchCriteriaId": "38D904CC-7C9A-4A9A-9A82-96FD6C821BB3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.203",
"matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.167",
"matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.130",
"matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.78",
"matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.20",
"matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.10",
"matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}