CVE-2026-31595: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31595 Overview

CVE-2026-31595 is a race condition vulnerability in the Linux kernel's PCI endpoint subsystem, specifically affecting the pci-epf-vntb (Virtual NTB Endpoint Function) driver. The vulnerability occurs when the epf_ntb_epc_cleanup function fails to properly stop the cmd_handler delayed work before clearing BAR mappings and doorbells. This allows the delayed work handler to execute after critical resources have been freed, resulting in a use-after-free condition that leads to kernel crashes.

Critical Impact
Local attackers with low privileges can trigger a kernel crash leading to denial of service through improper work queue synchronization in the PCI endpoint driver.

Affected Products

Linux Kernel with PCI endpoint pci-epf-vntb module enabled
Systems utilizing PCI NTB (Non-Transparent Bridge) endpoint functionality
Linux distributions with affected kernel versions

Discovery Timeline

April 24, 2026 - CVE-2026-31595 published to NVD
April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31595

Vulnerability Analysis

This vulnerability represents a classic race condition scenario in the Linux kernel's work queue subsystem. The pci-epf-vntb driver implements a command handler (epf_ntb_cmd_handler) that runs as delayed work to process commands from the endpoint function. When the epf_ntb_epc_cleanup function is called to tear down resources, it clears BAR mappings and doorbell configurations. However, the cleanup routine does not ensure that any pending or in-progress cmd_handler work is cancelled or completed before resource deallocation begins.

When the cmd_handler work executes after resources have been freed, it attempts to access memory that is no longer valid. The kernel call trace provided in the CVE description shows the crash occurring at epf_ntb_cmd_handler+0x54/0x200 within the pci_epf_vntb module, triggered through the standard work queue execution path (process_one_work → worker_thread → kthread).

The crash manifests as an "Unable to handle kernel paging request" at virtual address ffff800083f46004, indicating the handler attempted to dereference a pointer to freed or unmapped memory. The resulting kernel oops causes a system crash, leading to denial of service.

Root Cause

The root cause is missing synchronization between the cleanup path and the delayed work queue. The epf_ntb_epc_cleanup function should call cancel_delayed_work_sync() to ensure the cmd_handler work item is completely stopped before proceeding with resource teardown. Without this synchronization, a timing window exists where the work handler can be scheduled or actively running while cleanup deallocates the resources it depends on.

Attack Vector

The attack vector requires local access to the system with low privileges. An attacker can exploit this vulnerability by triggering the cleanup path while the delayed work is pending or executing. This can be accomplished through:

Manipulating PCI device state transitions that invoke the cleanup routine
Triggering module unload/reload sequences while the work queue has pending items
Racing the cleanup function against the scheduled work handler execution

The exploitation results in a kernel crash (denial of service) rather than code execution, as the vulnerability leads to accessing freed memory rather than controllable memory corruption.

Detection Methods for CVE-2026-31595

Indicators of Compromise

Kernel oops messages referencing epf_ntb_cmd_handler in the pci_epf_vntb module
System crashes with "Unable to handle kernel paging request" errors during PCI endpoint operations
Unexpected system reboots on systems with PCI NTB endpoint functionality enabled
Kernel log entries showing SMP internal errors with call traces through process_one_work

Detection Strategies

Monitor system logs for kernel oops events involving the pci_epf_vntb module
Enable kernel crash dump analysis to capture debugging information for root cause analysis
Deploy system monitoring to track unexpected kernel panic events on affected systems
Implement auditd rules to log PCI device state changes and module operations

Monitoring Recommendations

Configure kdump or similar crash dump mechanisms to capture diagnostic data
Set up centralized log aggregation to correlate kernel errors across multiple systems
Monitor for repeated system crashes that may indicate exploitation attempts
Review dmesg output regularly for warnings or errors related to the PCI endpoint subsystem

How to Mitigate CVE-2026-31595

Immediate Actions Required

Apply the kernel patches from upstream as soon as they are available for your distribution
If patching is not immediately possible, consider disabling the pci-epf-vntb module if NTB endpoint functionality is not required
Implement access controls to limit local user access on systems where the vulnerable driver is loaded
Monitor affected systems for signs of crashes or denial of service conditions

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds proper work queue synchronization by calling cancel_delayed_work_sync() in the epf_ntb_epc_cleanup function before proceeding with resource deallocation. The following commits contain the fix:

Workarounds

Unload or blacklist the pci_epf_vntb module if PCI NTB endpoint functionality is not required on the system
Restrict physical and local access to systems utilizing the vulnerable driver
Implement kernel live patching solutions if available for your distribution to apply fixes without rebooting
Monitor and limit module load/unload operations through security policies

bash

# Blacklist the vulnerable module if not needed
echo "blacklist pci_epf_vntb" >> /etc/modprobe.d/blacklist-cve-2026-31595.conf

# Unload the module if currently loaded
modprobe -r pci_epf_vntb

# Verify module is not loaded
lsmod | grep pci_epf_vntb