CVE-2026-31645: Linux Kernel Page Pool Leak Vulnerability

CVE-2026-31645 Overview

CVE-2026-31645 is a memory leak vulnerability in the Linux kernel's lan966x network driver affecting the FDMA (Frame Direct Memory Access) subsystem. The vulnerability exists in the error handling paths of lan966x_fdma_rx_alloc() and lan966x_fdma_init() functions, where page pools are created but not properly destroyed when subsequent operations fail. This resource leak can lead to memory exhaustion and denial of service conditions on affected systems.

Critical Impact
Local attackers with low privileges can trigger repeated memory allocation failures, causing kernel memory exhaustion and system instability through page pool resource leaks.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 6.2
Linux Kernel 7.0 (rc1 through rc7)

Discovery Timeline

2026-04-24 - CVE CVE-2026-31645 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31645

Vulnerability Analysis

This vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), commonly known as a memory leak. The flaw resides in the lan966x Ethernet driver's FDMA implementation, which is responsible for high-performance packet processing on Microchip LAN966x network processors.

The vulnerability manifests in two distinct error paths within the FDMA initialization code. When lan966x_fdma_rx_alloc() creates a page pool for receive buffer management but the subsequent fdma_alloc_coherent() call fails, the previously allocated page pool is not destroyed, resulting in leaked kernel memory. Similarly, in lan966x_fdma_init(), when lan966x_fdma_tx_alloc() fails after a successful lan966x_fdma_rx_alloc() call, the coherent DMA memory is freed but the page pool created for RX operations is not destroyed.

The impact is availability-focused, as repeated triggering of these error conditions can exhaust kernel memory resources, potentially causing system instability or denial of service.

Root Cause

The root cause is improper resource cleanup in error handling code paths. The kernel developers failed to add page_pool_destroy() calls when unwinding partial initialization states. This is a common pattern of resource leak vulnerabilities where cleanup logic does not mirror the allocation sequence in reverse order.

Attack Vector

The attack vector requires local access to the system with low privileges. An attacker would need to trigger conditions that cause fdma_alloc_coherent() or lan966x_fdma_tx_alloc() to fail repeatedly, such as by exhausting DMA-capable memory regions or manipulating system resource limits. Each failed initialization attempt leaks page pool memory that cannot be reclaimed without a system reboot.

The vulnerability does not directly allow code execution or information disclosure, but sustained exploitation can degrade system performance and eventually cause denial of service through memory exhaustion.

Detection Methods for CVE-2026-31645

Indicators of Compromise

Unusual increase in kernel memory consumption over time on systems with lan966x network hardware
Repeated error messages in kernel logs related to fdma_alloc_coherent or FDMA initialization failures
System instability or out-of-memory conditions on embedded systems using LAN966x processors

Detection Strategies

Monitor kernel memory allocation statistics using /proc/meminfo and /proc/slabinfo for unexpected growth patterns
Implement kernel tracing using ftrace or eBPF to track page_pool_create() and page_pool_destroy() call pairs
Review system logs for lan966x driver error messages indicating FDMA allocation failures

Monitoring Recommendations

Deploy memory monitoring solutions that track kernel memory usage trends on affected systems
Configure alerting thresholds for kernel memory consumption that could indicate resource exhaustion attacks
Utilize SentinelOne Singularity platform for continuous endpoint monitoring and anomalous resource usage detection

How to Mitigate CVE-2026-31645

Immediate Actions Required

Update the Linux kernel to a patched version that includes the fix for this vulnerability
If immediate patching is not possible, consider temporarily disabling or unloading the lan966x network driver on non-critical systems
Monitor affected systems for signs of memory exhaustion or unusual resource consumption

Patch Information

The Linux kernel maintainers have released patches that add the missing page_pool_destroy() calls in both error paths. The fix ensures proper cleanup of allocated page pools when subsequent operations fail during FDMA initialization. Multiple commits have been merged to address this issue across different kernel branches:

Workarounds

Blacklist the lan966x driver module on systems where the network hardware is not actively used
Implement resource limits using cgroups to contain potential memory exhaustion
Monitor and restart affected services or reboot systems if memory leak symptoms are detected

bash

# Blacklist the lan966x driver if not required
echo "blacklist lan966x" | sudo tee /etc/modprobe.d/blacklist-lan966x.conf
sudo update-initramfs -u

# Monitor kernel memory usage
watch -n 5 'cat /proc/meminfo | grep -E "MemFree|Slab|PageTables"'