CVE-2026-31656: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31656 Overview

CVE-2026-31656 is a race condition in the Linux kernel's drm/i915/gt graphics driver. The flaw produces a use-after-free and reference count underflow [CWE-191] in intel_engine_park_heartbeat(). Two concurrent code paths can release the same engine->heartbeat.systole request object. The heartbeat worker reads the pointer and calls i915_request_put(), but clears the pointer in a separate non-atomic step. A parallel request retirement on another CPU can drive the engine wakeref to zero and trigger __engine_park(), which calls intel_engine_park_heartbeat() and performs a second put on the stale pointer.

Critical Impact
A local attacker with the ability to exercise the Intel i915 GPU driver can trigger memory corruption, kernel panic, or potential local privilege escalation through the refcount underflow.

Affected Products

Linux Kernel (multiple stable branches addressed by upstream commits)
Linux Kernel 5.5
Linux Kernel 7.0-rc1 through 7.0-rc7

Discovery Timeline

2026-04-24 - CVE-2026-31656 published to the National Vulnerability Database
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31656

Vulnerability Analysis

The defect lives in the i915 GT (graphics translation) heartbeat subsystem, which periodically issues requests to detect hung GPU engines. The heartbeat worker and the engine park path both attempt to release engine->heartbeat.systole. Because the read of the pointer and the clearing write are not atomic, both paths can observe the same non-NULL value and each call i915_request_put(). The second put drops the reference count below zero, producing the refcount_warn_saturate warning visible in the reported call trace.

The upstream fix replaces the non-atomic read-then-clear sequence with xchg(). The xchg() instruction atomically reads the old pointer and writes NULL in a single hardware operation. Only one caller observes the non-NULL pointer and performs the put; the other observes NULL and skips the call.

Root Cause

The root cause is a time-of-check time-of-use race between two kernel paths that share ownership of engine->heartbeat.systole. The pointer is freed and cleared in two separate operations, which violates the invariant that exactly one caller can release the request.

Attack Vector

Exploitation requires local access with the ability to submit GPU work to an Intel i915-managed engine. Triggering the race is timing-dependent because the heartbeat worker and engine retirement must execute concurrently across CPUs. Successful exploitation corrupts kernel reference counts and may lead to use-after-free conditions on i915_request objects.

No public proof-of-concept is available for CVE-2026-31656, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream commit ca3f48c for the source-level fix.

Detection Methods for CVE-2026-31656

Indicators of Compromise

Kernel log entries containing refcount_warn_saturate originating from intel_engine_park_heartbeat or __engine_park
Stack traces referencing i915_request_retire, intel_context_exit_engine, or ____intel_wakeref_put_last in the i915 module
Unexpected GPU hangs, display freezes, or system instability on hosts using Intel integrated graphics

Detection Strategies

Monitor dmesg and /var/log/kern.log for refcount warnings tied to the i915 module
Inventory Linux hosts running affected kernel versions with the i915 driver loaded by checking lsmod | grep i915
Correlate kernel oops events with workloads that heavily exercise the GPU, such as graphics rendering or compute jobs

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log pipeline for analysis of WARN and BUG signatures
Track kernel version inventory across the fleet to confirm patch coverage
Alert on repeated GPU driver crashes from the same host, which may indicate exploitation attempts

How to Mitigate CVE-2026-31656

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that incorporates the upstream i915 heartbeat fix
Identify hosts running affected kernel versions and prioritize patching for workstations and servers with Intel graphics hardware
Restrict local user access on multi-tenant systems until patches are deployed

Patch Information

The vulnerability is resolved upstream by cherry-pick 13238dc0ee4f9ab8dafa2cca7295736191ae2f42, which replaces the non-atomic pointer manipulation with xchg(). Backports are available across multiple stable branches. See the published kernel commits: 2af8b20, 455d98e, 4c71fd0, 70d3e62, 8ce44d2, a00e92b, and ca3f48c.

Workarounds

Where patching is delayed, disable the i915 heartbeat by setting a high or zero value for the per-engine heartbeat_interval_ms sysfs attribute to reduce race exposure
Blacklist the i915 driver on systems that do not require Intel graphics functionality
Limit local logon and GPU compute access to trusted users to reduce the attack surface

bash

# Verify running kernel version and i915 module status
uname -r
lsmod | grep i915

# Reduce heartbeat frequency on each engine (workaround, requires root)
for f in /sys/class/drm/card*/engine/*/heartbeat_interval_ms; do
  echo 0 | sudo tee "$f"
done

# Apply distribution kernel update
sudo apt update && sudo apt install --only-upgrade linux-image-generic
# or, for RHEL-based systems
sudo dnf update kernel