CVE-2026-31594

Vulnerability

In the Linux kernel, the PCI endpoint function driver for NTB (pci-epf-vntb) contains a bug where epf_ntb_epc_destroy() performs a duplicate teardown of resources that the caller is expected to handle later. This double-free of EPC (Endpoint Controller) resources leads to a use-after-free condition, manifesting as a kernel oops when allow_link fails or when drop_link is invoked [1].

Exploitation

The vulnerability is triggered through the configfs interface used to manage PCI endpoint functions. An attacker with local access and the ability to create or manipulate configfs symbolic links can cause the kernel to call pci_primary_epc_epf_link(), which in turn invokes the flawed teardown path. No special privileges beyond the ability to interact with configfs are required, making this a local denial-of-service vector [1].

Impact

Successful exploitation results in a kernel panic (oops) due to a NULL-pointer dereference, as shown in the call trace: pci_epc_remove_epf followed by pci_primary_epc_epf_link. This crashes the system, leading to a denial of service. The oops occurs because the code attempts to access memory that has already been freed [1].

Mitigation

The fix removes the duplicate teardown helper and drops the premature pci_epc_put() call, relying instead on the proper refcounting tied to the configfs EPC group lifetime. The patch has been applied to the stable kernel tree [1]. Users should update to a kernel version containing the commit e238ab12556b or later.