CVE-2026-31501: Linux Kernel use-after-free (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path. Defer the descriptor free until after all accesses through the psdata pointer are complete. For emac_rx_packet(), move the free into the requeue label so both early-exit and success paths free the descriptor after all accesses are done. For emac_rx_packet_zc(), move the free to the end of the loop body after emac_dispatch_skb_zc() (which calls emac_rx_timestamp()) has returned.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux Kernel≥ 6.15.1 < 6.19.11 · 6.15 · 7.0

Remediation

Fixed in

Linux Kernel≥ 6.19.11

Patch & vendor advisories

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-31501 being actively exploited?

CVE-2026-31501 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.55%.

How severe is CVE-2026-31501?

CVE-2026-31501 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.55% probability of exploitation.

Which products are affected by CVE-2026-31501?

Affected products include Linux Kernel.

How do I fix CVE-2026-31501?

Upgrade affected software to a fixed version, for example Linux Kernel 6.19.11 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-31501 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo