CVE-2026-31644

net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

Published Apr 24, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

When lan966x_fdma_reload() fails to allocate new RX buffers, the restore
path restarts DMA using old descriptors whose pages were already freed
via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can
release pages back to the buddy allocator, the hardware may DMA into
memory now owned by other kernel subsystems.

Additionally, on the restore path, the newly created page pool (if
allocation partially succeeded) is overwritten without being destroyed,
leaking it.

Fix both issues by deferring the release of old pages until after the
new allocation succeeds. Save the old page array before the allocation
so old pages can be freed on the success path. On the failure path, the
old descriptors, pages and page pool are all still valid, making the
restore safe. Also ensure the restore path re-enables NAPI and wakes
the netdev, matching the success path.

Analysis

Technical impact

The lan966x network driver contains a use‑after‑free and memory leak triggered when lan966x_fdma_reload() fails to allocate new receive buffers. The driver attempts to restart DMA with descriptors whose pages have already been freed, exposing the system to DMA writes into memory no longer under its control. This flaw is a form of memory corruption (CWE-416) that can overwrite kernel data structures, and the leaked page pool can further expose kernel memory for manipulation.

Affected Systems

All Linux kernel releases that ship the lan966x driver, including kernel 6.12 and the 7.0 release candidates up to rc7. Any system using a network interface based on the lan966x hardware is at risk.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.8, indicating high severity. The EPSS score is below 1 %, suggesting very low probability of exploitation in the wild. The bug is not listed in the CISA KEV catalog, and exploitation would likely require an attacker with local privileged or kernel access to trigger the DMA reload and map the freed pages into the target's address space. Overall, the attack surface is narrow, but the impact is severe should the flaw be leveraged.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`89ba464fcf548d64bc7215dfe769f791330ae8b6`	affected	< 691082c0b93c13a5e068c0905f673060bddc204e
`89ba464fcf548d64bc7215dfe769f791330ae8b6`	affected	< 92a673019943770930e2a8bfd52e1aad47a1fc1f
`89ba464fcf548d64bc7215dfe769f791330ae8b6`	affected	< 9950e9199b3dfdfbde0b8d96ba947d7b11243801
`89ba464fcf548d64bc7215dfe769f791330ae8b6`	affected	< 59c3d55a946cacdb4181600723c20ac4f4c20c84

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.12.82`	unaffected	≤ 6.12.*
`6.18.23`	unaffected	≤ 6.18.*
`6.19.13`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.12:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[89ba464fcf548d64bc7215dfe769f791330ae8b6,691082c0b93c13a5e068c0905f673060bddc204e)`	affected	code_commit	—
`[89ba464fcf548d64bc7215dfe769f791330ae8b6,92a673019943770930e2a8bfd52e1aad47a1fc1f)`	affected	code_commit	—
`[89ba464fcf548d64bc7215dfe769f791330ae8b6,9950e9199b3dfdfbde0b8d96ba947d7b11243801)`	affected	code_commit	—
`[89ba464fcf548d64bc7215dfe769f791330ae8b6,59c3d55a946cacdb4181600723c20ac4f4c20c84)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.12`	affected	semver	—
`[0,6.12)`	unaffected	semver	—
`[6.12.82,6.13.0)`	unaffected	semver	—
`[6.18.23,6.19.0)`	unaffected	semver	—
`[6.19.13,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that defers release of old pages until the new allocation succeeds and restores safe DMA behavior, such as updating to Linux kernel 6.12.1 or newer 7.0 releases that contain the fix.
If an immediate kernel upgrade is not possible, remove or disable the lan966x driver or disable the network interface that uses the FDMA reload path to prevent the flaw from being triggered.
Ensure that any custom builds or modules for lan966x incorporate the same logic changes—saving the old page array before allocation and freeing it only on successful re‑initialization—to eliminate the use‑after‑free and memory leak.

Generated by OpenCVE AI on April 28, 2026 at 13:50 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.125% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84
https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e
https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f
https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801
https://lore.kernel.org/linux-cve-announce/2026042458-CVE-2026-31644-34ba@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31644
https://www.cve.org/CVERecord?id=CVE-2026-31644

History

Apr 27, 2026 8:30 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:6.12:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Apr 27, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Apr 25, 2026 12:15 AM Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026042458-CVE-2026-31644-34ba@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31644 https://www.cve.org/CVERecord?id=CVE-2026-31644

Apr 24, 2026 3:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() When lan966x_fdma_reload() fails to allocate new RX buffers, the restore path restarts DMA using old descriptors whose pages were already freed via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can release pages back to the buddy allocator, the hardware may DMA into memory now owned by other kernel subsystems. Additionally, on the restore path, the newly created page pool (if allocation partially succeeded) is overwritten without being destroyed, leaking it. Fix both issues by deferring the release of old pages until after the new allocation succeeds. Save the old page array before the allocation so old pages can be freed on the success path. On the failure path, the old descriptors, pages and page pool are all still valid, making the restore safe. Also ensure the restore path re-enables NAPI and wakes the netdev, matching the success path.
Title		net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84 https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801