Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31594— PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于PCI endpoint驱动pci-epf-vntb中epf_ntb_epc_destroy()重复释放资源，导致.allow_link失败或.drop_link执行时发生内核崩溃。

AI Predicted 4.4 Difficulty: Moderate EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 19

VendorProduct Version RangeStatus
Linux Linux e2b6ef72b7aea9d7d480d2df499bcd1c93247abb< 305a0674bc552bfcc3231e23fb91cf4f62aec168 affected
e35f56bb03304abc92c928b641af41ca372966bb< b261027a1a235d8925e332363f23135a0eff2b35 affected
e35f56bb03304abc92c928b641af41ca372966bb< e238ab12556b00f3b4d8b870b32ba1e4f4d4ebc2 affected
e35f56bb03304abc92c928b641af41ca372966bb< 73bf218de28d039126dc64281d2b47dd3c46a0a3 affected
e35f56bb03304abc92c928b641af41ca372966bb< cec9ead73ab154a7953f6ab8dd5127e0d6bbf95a affected
e35f56bb03304abc92c928b641af41ca372966bb< 478e776101592eb63298714e96823ef78a3295ec affected
e35f56bb03304abc92c928b641af41ca372966bb< a7a3cab4d33fd8a8aed864c447d0d7c99e85404e affected
e35f56bb03304abc92c928b641af41ca372966bb< 0da63230d3ec1ec5fcc443a2314233e95bfece54 affected
… +11 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31594

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to perform later. This leads to an oops when .allow_link fails or when .drop_link is performed. The following is an example oops of the former case: Unable to handle kernel paging request at virtual address dead000000000108 [...] [dead000000000108] address between user and kernel address ranges Internal error: Oops: 0000000096000044 [#1] SMP [...] Call trace: pci_epc_remove_epf+0x78/0xe0 (P) pci_primary_epc_epf_link+0x88/0xa8 configfs_symlink+0x1f4/0x5a0 vfs_symlink+0x134/0x1d8 do_symlinkat+0x88/0x138 __arm64_sys_symlinkat+0x74/0xe0 [...] Remove the helper, and drop pci_epc_put(). EPC device refcounting is tied to the configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于PCI endpoint驱动pci-epf-vntb中epf_ntb_epc_destroy()重复释放资源，导致.allow_link失败或.drop_link执行时发生内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e2b6ef72b7aea9d7d480d2df499bcd1c93247abb ~ 305a0674bc552bfcc3231e23fb91cf4f62aec168 -
Linux Linux 6.0 -

II. Public POCs for CVE-2026-31594

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31594

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31594 (5)

Same Patch Batch · Linux · 2026-04-24 · 138 CVEs total

CVE-2026-31637 9.8 CRITICAL rxrpc: reject undecryptable rxkad response tickets
CVE-2026-31609 9.8 CRITICAL smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
CVE-2026-31608 9.8 CRITICAL smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list
CVE-2026-31633 9.8 CRITICAL rxrpc: Fix integer overflow in rxgk_verify_response()
CVE-2026-31657 9.8 CRITICAL batman-adv: hold claim backbone gateways by reference
CVE-2026-31669 9.8 CRITICAL mptcp: fix slab-use-after-free in __inet_lookup_established
CVE-2026-31668 9.8 CRITICAL seg6: separate dst_cache for input and output paths in seg6 lwtunnel
CVE-2026-31607 9.8 CRITICAL usbip: validate number_of_packets in usbip_pack_ret_submit()
CVE-2026-31536 9.8 CRITICAL smb: server: let send_done handle a completion without IB_SEND_SIGNALED
CVE-2026-31659 9.8 CRITICAL batman-adv: reject oversized global TT response buffers
CVE-2026-31649 9.8 CRITICAL net: stmmac: fix integer underflow in chain mode
CVE-2026-31589 9.8 CRITICAL mm: call ->free_folio() directly in folio_unmap_invalidate()
CVE-2026-31636 9.1 CRITICAL rxrpc: fix RESPONSE authenticator parser OOB read
CVE-2026-31570 8.8 HIGH can: gw: fix OOB heap access in cgw_csum_crc8_rel()
CVE-2026-31558 8.8 HIGH LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
CVE-2026-31553 8.8 HIGH KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
CVE-2026-31588 8.8 HIGH KVM: x86: Use scratch field in MMIO fragment to hold small write values
CVE-2026-31629 8.8 HIGH nfc: llcp: add missing return after LLCP_CLOSED checks
CVE-2026-31622 8.8 HIGH NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
CVE-2026-31611 8.6 HIGH ksmbd: require 3 sub-authorities before reading sub_auth[2]

Showing top 20 of 138 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31594

No comments yet

Leave a comment