CVE-2026-31573: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31573 Overview

CVE-2026-31573 is a Linux kernel vulnerability in the Verisilicon Hantro Video Processing Unit (VPU) media driver. The flaw stems from misuse of the __initconst annotation on the imx8mq_vpu_shared_resources array. When the driver is built as a loadable module, the kernel frees __initconst data after module initialization completes. However, variant structures reference this data through their shared_devices field during probe, triggering a page fault and kernel panic.

The vulnerability affects local systems running affected Linux kernel versions where the hantro_vpu module is loaded. Successful triggering produces an unhandled kernel paging request, resulting in denial of service.

Critical Impact
A local user loading the hantro_vpu driver as a module can trigger a kernel panic through normal probe operations, including probe deferrals or unbind-bind cycles.

Affected Products

Linux Kernel (mainline, prior to fix commits)
Verisilicon Hantro VPU driver (hantro_vpu) built as a kernel module
Systems using the i.MX8MQ VPU variant with imx8mq_vpu_shared_resources

Discovery Timeline

2026-04-24 - CVE-2026-31573 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31573

Vulnerability Analysis

The defect resides in the media: verisilicon driver, specifically in how the imx8mq_vpu_shared_resources array is declared. The array carries the __initconst attribute, which instructs the kernel to place the data in a section that is reclaimed after initialization finishes.

When built as a loadable module, the kernel discards __initconst data once module init returns. The variant structures, however, retain pointers to this array through their shared_devices field. During hantro_probe(), the driver calls of_find_matching_node_and_match() against the freed memory, producing the kernel paging request shown in the crash log:

Unable to handle kernel paging request at virtual address ffffd9c18eb05000
of_find_matching_node_and_match+0x5c/0x1a0
hantro_probe+0x2f4/0x7d0 [hantro_vpu]

Root Cause

The root cause is incorrect lifetime annotation. __initconst and __initconst_or_module mark data as init-only, meaning the memory is reclaimed after init completes. The imx8mq_vpu_shared_resources array is accessed from non-init probe code paths, including probe deferral and unbind-bind cycles, so its data must persist for the lifetime of the module.

Attack Vector

Exploitation requires local access with privileges sufficient to trigger driver probe operations. The crash is reachable through normal driver loading, probe deferrals where the device tree match runs after init has completed, or administrator-driven unbind-bind sequences via sysfs. The result is a kernel availability impact rather than confidentiality or integrity loss, consistent with the CWE classification of [NVD-CWE-noinfo].

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-31573

Indicators of Compromise

Kernel log entries containing Unable to handle kernel paging request referencing of_find_matching_node_and_match and hantro_probe
Unexpected kernel panics or oops messages on systems loading the hantro_vpu module
Failed probe attempts following EPROBE_DEFER conditions on i.MX8MQ-based hardware

Detection Strategies

Monitor dmesg and /var/log/kern.log for paging request faults that resolve to symbols within [hantro_vpu]
Audit installed kernel versions across managed Linux fleets to identify hosts predating the upstream fix commits
Track kernel module load events using auditd rules on init_module and finit_module syscalls

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging or SIEM solution for correlation across Linux endpoints
Alert on repeated kernel oops events that share the same call stack signature involving hantro_probe
Inventory devices using ARM64 i.MX8MQ platforms where the Verisilicon VPU driver is likely to be loaded

How to Mitigate CVE-2026-31573

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 1e7e9119cf9b0d8585b27653b1a6dc31397c252e and e8d97c270cb46a2a88739019d0f8547adc7d97da
Update to a stable Linux kernel release that incorporates the fix for the __initconst misuse in the Verisilicon driver
Restrict the ability to bind and unbind drivers via sysfs to privileged administrative accounts only

Patch Information

The fix removes the __initconst annotation from imx8mq_vpu_shared_resources, allowing the data to reside in the normal .rodata section where it remains valid for the lifetime of the module. Patch details are available in the Kernel Git Commit 1e7e9119 and Kernel Git Commit e8d97c27.

Workarounds

Build the Verisilicon Hantro VPU driver into the kernel image rather than as a loadable module, which prevents the post-init reclamation behavior from manifesting
Blacklist the hantro_vpu module on systems that do not require hardware video acceleration until the patched kernel is deployed
Avoid manual unbind-bind cycles on the affected driver in production environments

bash

# Blacklist the hantro_vpu module until patching is complete
echo "blacklist hantro_vpu" | sudo tee /etc/modprobe.d/blacklist-hantro.conf
sudo update-initramfs -u