CVE-2026-31440

Vulnerability

Description

In the Linux kernel's idxd DMA engine driver, a memory leak occurs during device removal. When the device is removed, a reset is performed, which returns configuration registers to their default state (zero). The driver's cleanup code checks whether event log support was enabled by reading a configuration register; after the reset, this register reads zero, causing the driver to skip deallocating the event log memory. This results in a memory leak because the allocated memory for the event log is never freed [1][2][3][4].

Exploitation

The vulnerability is triggered during normal device removal operations, such as unbinding the driver or hot-unplugging the device. An attacker who can repeatedly trigger device removal (e.g., through physical access or by exploiting other vulnerabilities that cause device removal) could cause the kernel to leak memory each time. No authentication or special privileges are required beyond the ability to remove the device, making this a potential denial-of-service vector.

Impact

The primary impact is a kernel memory leak. Over time, repeated device removal events can exhaust kernel memory, leading to system instability, resource exhaustion, and ultimately a denial-of-service condition. The CVSS v3 score of 5.5 (Medium) reflects this limited but tangible impact.

Mitigation

The fix removes the faulty check on the configuration register and instead relies on the idxd->evl pointer being non-NULL, which is only set if the hardware actually supports the event log feature. This ensures that the event log memory is always deallocated when it was previously allocated. The patch has been applied to multiple stable kernel branches as seen in the referenced commits [1][2][3][4].