CVE-2026-31686: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31686 Overview

A double free vulnerability has been identified in the Linux kernel's KASAN (Kernel Address Sanitizer) subsystem, specifically within the kasan_free_pxd() function responsible for page table management. The vulnerability stems from an incorrect assumption that page tables are always struct page aligned, which is not true across all architectures.

On PowerPC systems with 64K pagesize configurations, PUD (Page Upper Directory) tables of size 4096 bytes are allocated from the slab cache named pgtable-2^9. The kasan_free_pxd() function incorrectly uses page_to_virt(pxd_page()) instead of directly passing the start of the pXd table, leading to a double free condition when PMEM (Persistent Memory) operations trigger shadow memory removal via kasan_remove_zero_shadow().

Critical Impact
This vulnerability can cause kernel memory corruption and potential denial of service through double free conditions in the memory management subsystem, particularly affecting systems using PMEM with PowerPC architectures.

Affected Products

Linux kernel with KASAN enabled
PowerPC systems with 64K pagesize configuration
Systems utilizing PMEM (Persistent Memory) functionality

Discovery Timeline

2026-04-27 - CVE CVE-2026-31686 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31686

Vulnerability Analysis

The root cause of this double free vulnerability lies in the kasan_free_pxd() function's handling of page table deallocation. The function assumes universal struct page alignment for page tables, but this assumption breaks down on architectures with non-standard page sizes.

On PowerPC systems configured with 64K pages, PUD tables are allocated through the slab allocator using the pgtable-2^9 cache. These 4096-byte allocations do not maintain the struct page alignment expected by kasan_free_pxd(). When the function attempts to convert a page descriptor back to a virtual address using page_to_virt(pxd_page()), it calculates an incorrect address that may have already been freed.

The vulnerability is triggered during PMEM unmapping operations when memunmap_pages() calls kasan_remove_zero_shadow(). The incorrect address calculation causes kmem_cache_free() to attempt freeing memory that was already released, triggering KASAN's double-free detection mechanism.

Root Cause

The architectural inconsistency between expected page table alignment and actual slab-allocated memory layout causes the address miscalculation. The fix involves directly passing the start of the pXd table as the first argument rather than performing potentially incorrect page-to-virtual conversions.

Attack Vector

This vulnerability is locally exploitable and requires specific conditions to manifest:

The attack scenario involves operations that trigger PMEM memory unmapping, which can occur during device unbind operations through sysfs. The call chain flows through device_release_driver_internal() → devres_release_all() → devm_action_release() → memunmap_pages() → kasan_remove_zero_shadow() → kasan_free_pxd().

While the vulnerability requires local access and specific hardware configurations (PowerPC with 64K pagesize and PMEM), the kernel memory corruption could potentially be leveraged for privilege escalation or denial of service attacks.

Detection Methods for CVE-2026-31686

Indicators of Compromise

KASAN reports in kernel logs indicating double-free conditions at addresses within pgtable-2^9 slab cache
Kernel panic or system instability during PMEM device unbind operations
Memory state errors showing fc (freed) markers around buggy addresses in KASAN output
Syslog entries containing BUG: KASAN: double-free in kasan_remove_zero_shadow

Detection Strategies

Monitor kernel logs for KASAN double-free warnings, particularly those referencing kasan_remove_zero_shadow or pgtable-2^9 cache
Implement system monitoring for unexpected kernel taints, specifically those disabling lock debugging due to memory corruption
Deploy kernel tracing on kmem_cache_free() calls targeting page table caches on affected architectures
Review system stability during PMEM operations and device driver unbind sequences

Monitoring Recommendations

Enable KASAN in development and testing environments to proactively detect memory safety issues
Configure kernel log aggregation to alert on memory corruption signatures
Monitor PowerPC systems with PMEM for abnormal memory allocation patterns in page table caches
Implement automated testing of PMEM map/unmap cycles on affected architectures

How to Mitigate CVE-2026-31686

Immediate Actions Required

Apply the kernel patches from the official git repository commits provided in the security references
Prioritize patching for PowerPC systems with 64K pagesize configurations using PMEM functionality
Consider temporarily disabling KASAN on production systems if patching cannot be performed immediately
Review and restrict access to sysfs device unbind operations where possible

Patch Information

The fix modifies kasan_free_pxd() to directly use the pXd table pointer passed as the first argument rather than performing page_to_virt(pxd_page()) conversions. Multiple kernel commits have been released to address this vulnerability across different stable kernel branches:

Workarounds

Disable KASAN in kernel configuration if the feature is not required for production workloads
Avoid PMEM unmap operations on affected PowerPC systems until patches can be applied
Restrict access to device driver unbind functionality through sysfs permissions
Consider using alternative architectures for PMEM-intensive workloads until the patch is deployed

bash

# Check if system is affected by verifying architecture and page size
uname -m
getconf PAGESIZE

# Verify KASAN status in kernel config
zcat /proc/config.gz | grep CONFIG_KASAN

# Monitor for double-free indicators in kernel logs
dmesg | grep -i "double-free\|kasan"