CVE-2026-31440 addresses a memory leak in the Linux kernel's dmaengine idxd driver. During device removal, the device reset causes configuration registers to reset to zero, invalidating the check for event log support before deallocation. The driver incorrectly checks if event log support was enabled rather than verifying if the event log memory was allocated, leading to a leak of event log memory. This flaw affects various Linux kernel versions prior to 6.8.0 and related Ubuntu kernel builds. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. Official patches have been released by Ubuntu and other Linux distributions to fix this issue.

The vulnerability causes leaking of event log memory during device removal in the dmaengine idxd driver, potentially leading to resource exhaustion and denial of service conditions. There is no direct confidentiality or integrity impact. The attack requires local access with low privileges and no user interaction. The scope remains unchanged, meaning the impact is limited to the affected component.

An official patch is available and included in Ubuntu security notices USN-8567-1 and USN-8574-1. Users should update their Linux kernel packages to the fixed versions and reboot their systems to apply the changes. Due to an ABI change in the kernel update, recompilation and reinstallation of third-party kernel modules may be necessary. Follow vendor instructions for updating and rebuilding kernel modules as needed.