{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-31468",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-03-09T15:48:24.097Z",
        "datePublished": "2026-04-22T13:53:57.583Z",
        "dateUpdated": "2026-08-05T12:22:47.492Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:22:47.492Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Fix double free in dma-buf feature\n\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\nown advice to only use dma_buf_put() after dma_buf_export(), instead\nfalling through the entire unwind chain.  In the unlikely event that\nwe encounter file descriptor exhaustion, this can result in an\nunbalanced refcount on the vfio device and double free of allocated\nobjects.\n\nAvoid this by moving the \"put\" directly into the error path and return\nthe errno rather than entering the unwind chain."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The vulnerable code is reached through a local VFIO device file ioctl, specifically VFIO_DEVICE_FEATURE on a VFIO PCI device. It is not reachable from network packets, adjacent radio traffic, or physical hotplug alone.\nAC:L - Once a caller has an opened VFIO PCI device that supports the dma-buf feature, the failure path can be driven by attacker-controlled file descriptor exhaustion and valid ioctl inputs. The relevant condition is under the attacker's process control rather than a race or external timing dependency.\nPR:L - The attacker needs local access to an opened/access-granted VFIO device fd, which is normally delegated by device node permissions or virtualization management policy. The ioctl path itself does not require real init-namespace root for normal IOMMU-backed VFIO devices, and VFIO is not made reachable through unprivileged user namespaces.\nUI:N - No victim interaction is required after the attacker has the VFIO device fd. The attacker directly invokes the ioctl and controls the file descriptor exhaustion condition.\nS:U - The bug corrupts kernel/VFIO memory from a local kernel interface, so the vulnerable and impacted security authority is the same kernel instance. This is not a guest-to-host escape path or a direct IOMMU/DMA boundary bypass by itself.\nC:H - The old unwind path calls dma_buf_put(), whose release callback frees the private VFIO dma-buf object and phys_vec, then continues to dereference and free those same objects again. This double free/use-after-free style heap corruption is reasonably exploitable for kernel memory disclosure primitives.\nI:H - The double free of attacker-influenced kernel heap objects can corrupt allocator metadata or enable reuse of freed objects, which is a kernel memory corruption primitive. Under the required overestimation rule, this supports high integrity impact due to plausible arbitrary write or code execution.\nA:H - Even without full exploitation, the double free and unbalanced VFIO device reference can trigger allocator corruption, UAF, oops, or panic. The attacker can repeat the ioctl path to cause a reliable local denial of service."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/vfio/pci/vfio_pci_dmabuf.c"
                    ],
                    "versions": [
                        {
                            "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
                            "lessThan": "83ad334afc9a645cef1062f5346526b1e36d6516",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
                            "lessThan": "e98137f0a874ab36d0946de4707aa48cb7137d1c",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/vfio/pci/vfio_pci_dmabuf.c"
                    ],
                    "versions": [
                        {
                            "version": "6.19",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.19",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.19.11",
                            "lessThanOrEqual": "6.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.19",
                                    "versionEndExcluding": "6.19.11"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.19",
                                    "versionEndExcluding": "7.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516"
                },
                {
                    "url": "https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c"
                }
            ],
            "title": "vfio/pci: Fix double free in dma-buf feature",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}