Skip to main content
VulnerabilityPublished Updated

CVE-2026-31441: Linux kernel · dmaengine: idxd: Fix memory leak when a wq is reset

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 22:33 UTC

Severity
Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
CISA SSVC
Exploitation
No evidence of active exploitation and no public proof of concept
Automatable
Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact
Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch
Available – fixed in d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478, a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658, a9e7815d38629bcf59d3005001f1f315424a58de +4

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 22 Apr 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • >=5.7.10 <5.8
Fixed in
  • d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478
  • a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658
  • a9e7815d38629bcf59d3005001f1f315424a58de
  • 54d77cc0c40ca2f894859dc7b3c52997574f1a2a
  • 39c1504e0e76bcfb93991fd94288a83e05d13b51
  • 5.8
  • 0c3d3ac57e3c52b570b8c695903306bff07e04c8
LinuxLinuxAffected
  • =5.8
Fixed in–

AI-suggested

This vulnerability has been fixed in Linux kernel version 5.8 and later. Users and administrators should upgrade to version 5.8 or apply the relevant patches to ensure the memory leak is resolved.

Description

A memory leak vulnerability in the Linux kernel's dmaengine idxd driver was fixed. The issue occurred when a workqueue (wq) was reset, and the wq type was set to NONE before releasing its resources, causing a leak. The fix ensures the wq type is set to NONE only after all resources are properly released.

References

Community reviews

Loading reviews…