CVE-2026-31443

Vulnerability

Description

CVE-2026-31443 is a bug in the Linux kernel's idxd DMA engine driver. The root cause is a missing check for whether the event log is supported by the hardware before attempting to restore it after a Function Level Reset (FLR). When the hardware does not support reporting errors to the event log, the driver still tries to restore the event log during error recovery, even though the log was never allocated [1][2].

Exploitation

Conditions

An attacker would need to trigger an error that causes an FLR on a system using the idxd driver with hardware that lacks event log support. No special privileges are required beyond the ability to induce such an error, which could potentially be achieved through malicious I/O or by exploiting other vulnerabilities that cause device errors. The attack surface is limited to systems with specific Intel DSA (Data Streaming Accelerator) hardware configurations.

Impact

If the bug is triggered, the driver attempts to dereference or operate on an uninitialized event log structure, leading to a kernel crash (NULL pointer dereference or similar). This results in a denial of service (DoS) on the affected system. The CVSS v3 score of 5.5 (Medium) reflects the local nature of the attack and the availability impact.

Mitigation

The fix, introduced in kernel commits [1][2][3], adds proper checks to ensure the event log is only restored or freed if it was previously allocated and supported by the hardware. Users should apply the latest stable kernel updates containing these patches. No workaround is available other than avoiding the vulnerable hardware configuration or disabling the idxd driver if not needed.