CVE-2026-31399

Vulnerability

Description

In the Linux kernel's NVDIMM subsystem, a use-after-free vulnerability exists in the nd_async_device_register() function. The issue occurs when device_add() fails (e.g., due to memory allocation failure). Prior patch b6eae0f61db2 added a reference on the parent device to be held until async initialization completes, but if device_add() fails, the device's reference count drops to zero before the parent pointer is accessed, leading to a use-after-free condition. This was reported by Dingisoul with KASAN [1].

Exploitation

Exploitation requires triggering a failure in device_add() during NVDIMM device registration. An attacker with the ability to influence memory pressure or cause resource exhaustion could potentially trigger this condition. The vulnerability is local and requires access to the NVDIMM subsystem, but no special privileges are needed beyond being able to trigger device registration.

Impact

A successful exploit could lead to memory corruption with potential escalation of privilege or system crash (denial of service). The use-after-free allows an attacker to manipulate freed memory, potentially leading to arbitrary code execution in kernel context.

Mitigation

The fix involves saving a reference to the parent pointer before calling device_add(), ensuring the parent reference is properly dropped regardless of the outcome [1]. The patch has been applied to the stable kernel trees as referenced in the commits. Users should update to the latest stable kernel containing these fixes.