CVE-2026-31443: Linux Kernel dmaengine Crash Vulnerability

CVE-2026-31443 Overview

CVE-2026-31443 is a kernel vulnerability in the Linux dmaengine: idxd driver. The flaw triggers a crash when the Intel Data Streaming Accelerator (IDXD) driver attempts to restore an event log that was never allocated. The condition occurs on hardware that does not support reporting errors to the event log when a Function Level Reset (FLR) event is received. A local user with low privileges can cause the kernel to fault, resulting in a denial of service on the affected host.

Critical Impact
A local low-privileged user can crash the kernel on systems using Intel IDXD hardware that lacks event log reporting support, producing high-availability impact.

Affected Products

Linux Kernel (mainline)
Linux Kernel 7.0-rc1 through 7.0-rc5
Systems using the idxd dmaengine driver with Intel Data Streaming Accelerator hardware

Discovery Timeline

2026-04-22 - CVE-2026-31443 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-31443

Vulnerability Analysis

The vulnerability resides in the Intel Data Streaming Accelerator (IDXD) dmaengine driver in the Linux kernel. The IDXD driver supports an event log feature used to surface hardware error information. When a Function Level Reset (FLR) is received, the driver runs a recovery path that attempts to restore the event log state.

The recovery path does not verify whether the event log was allocated before access. On hardware that does not advertise event log reporting support, the buffer is never allocated. Dereferencing the uninitialized log structure during FLR recovery triggers a kernel crash. A parallel issue exists in the teardown path, where the driver attempts to free the event log without checking allocation state.

The defect is classified as a kernel driver vulnerability with denial of service impact. Confidentiality and integrity are not affected, but availability is severely impacted on systems where the IDXD device generates an FLR event.

Root Cause

The root cause is a missing capability check in two code paths of the idxd driver. The FLR recovery routine assumes the event log buffer always exists, and the cleanup routine assumes the buffer must always be freed. Neither path consults the hardware capability flag indicating whether event log reporting is supported. The result is an invalid memory access on platforms without the feature.

Attack Vector

Exploitation requires local access with low privileges on a system using IDXD hardware. An attacker with the ability to interact with the device, or to induce error conditions that trigger an FLR, can force the driver into the faulty recovery path. The crash takes down the kernel and disrupts all services on the host. Remote exploitation is not feasible because the trigger requires hardware-level error signaling on the local platform.

No public proof-of-concept exploit is available, and the issue has not been observed in active exploitation campaigns.

Detection Methods for CVE-2026-31443

Indicators of Compromise

Unexpected kernel panics or oops messages referencing idxd driver functions in dmesg or /var/log/kern.log
System reboots correlated with Function Level Reset events on Intel Data Streaming Accelerator devices
Kernel call traces involving event log restore or free routines in the drivers/dma/idxd/ code paths

Detection Strategies

Audit running kernel versions across the fleet and flag hosts on Linux 7.0-rc1 through 7.0-rc5 that load the idxd module
Correlate idxd driver crash signatures from kernel logs with hardware error events reported by mcelog or rasdaemon
Monitor for repeated FLR events on IDXD PCIe devices using lspci -vvv output and PCIe AER (Advanced Error Reporting) logs

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on idxd panic signatures
Track uname -r output across endpoints to identify unpatched kernels running the vulnerable driver
Enable PCIe AER logging on systems with Intel IDXD accelerators to surface FLR triggers early

How to Mitigate CVE-2026-31443

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories to all systems running affected kernel versions
Identify hosts using the idxd driver with lsmod | grep idxd and prioritize them for patching
Restrict local access to systems with IDXD hardware until the patch is deployed

Patch Information

The fix is published in the upstream Linux stable tree. The driver was modified so that the FLR recovery path restores the event log only when it was previously allocated, and the teardown path frees the log only after verifying allocation. Patch commits are available at Kernel Git Commit - Fix, Kernel Git Commit - Update, and Kernel Git Commit - Enhancement.

Workarounds

Unload the idxd kernel module on systems that do not require Data Streaming Accelerator functionality using modprobe -r idxd
Blacklist the idxd module in /etc/modprobe.d/ to prevent automatic loading at boot on non-essential hosts
Disable IDXD devices in system firmware where the accelerator is not used by workloads

bash

# Configuration example
# Blacklist the idxd driver on hosts that do not require IDXD
echo "blacklist idxd" | sudo tee /etc/modprobe.d/blacklist-idxd.conf
sudo modprobe -r idxd
sudo update-initramfs -u