CVE-2026-31490

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Fix use-after-free in migration restore

When an error is returned from xe_sriov_pf_migration_restore_produce(), the data pointer is not set to NULL, which can trigger use-after-free in subsequent .write() calls. Set the pointer to NULL upon error to fix the problem.

(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 1ed30397c0b92b97381dbd11362fdbbf93e046d2, < e28552b4ddea5cb4725380dd08237831af835124; >= 1ed30397c0b92b97381dbd11362fdbbf93e046d2, < 87997b6c6516e049cbaf2fc6810b213d587a06b1
LinuxLinux6.19

References

Timeline

Published
Apr 22, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-314915.5In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Harden depth calculation functions An issue was exposed whCVE-2026-314925.5In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize free_qp completion before using it In irdma_creCVE-2026-314937.8In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix use of completion ctx after free On admin queue completiCVE-2026-314947.8In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential CVE-2026-314955.5In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manual rCVE-2026-314965.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via prCVE-2026-314975.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusb_work() mapsCVE-2026-314985.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop l2caCVE-2026-314995.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() caCVE-2026-31508.8A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/diCVE-2026-315007.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lockCVE-2026-315019.8In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path