CVE-2026-31595

Root

Cause

In the Linux kernel's PCI endpoint NTB driver (pci-epf-vntb), the epf_ntb_epc_cleanup function clears BAR mappings and doorbells without first stopping the delayed work queue (cmd_handler). This creates a race condition where the epf_ntb_cmd_handler work item can execute after the resources it accesses have been freed, leading to a use-after-free [1][2][3][4].

Exploitation

The vulnerability is triggered during device teardown or reconfiguration. An attacker with local access and the ability to trigger PCI endpoint removal or reset can cause the kernel to access freed memory. No special privileges beyond local user access are required, as the race occurs in normal driver cleanup paths [1][2][3][4].

Impact

Successful exploitation results in a kernel crash (Oops) due to an invalid memory access, as shown by the call trace in the CVE description. This can lead to a denial of service (system panic) or potentially allow an attacker to escalate privileges if the freed memory is reallocated and controlled [1][2][3][4].

Mitigation

The fix is to call cancel the delayed work (cancel_delayed_work) before tearing down resources in epf_ntb_epc_cleanup`. The patch has been applied to the Linux kernel stable branches and is available in commits [1][2][3][4]. Users should update to a kernel version containing the fix.