CVE-2026-31501: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
cppi5hdescgetpsdata() returns a pointer into the CPPI descriptor. In both emacrxpacket() and emacrxpacketzc(), the descriptor is freed via k3cppidescpoolfree() before the psdata pointer is used by emacrxtimestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path.
Defer the descriptor free until after all accesses through the psdata pointer are complete. For emacrxpacket(), move the free into the requeue label so both early-exit and success paths free the descriptor after all accesses are done. For emacrxpacketzc(), move the free to the end of the loop body after emacdispatchskbzc() (which calls emacrxtimestamp()) has returned.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31501?
CVE-2026-31501 is classified as a moderate severity vulnerability due to the potential for Denial of Service.
How do I fix CVE-2026-31501?
To fix CVE-2026-31501, you should upgrade to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-31501?
CVE-2026-31501 affects the Linux kernel, specifically implementations that utilize the CPPI descriptor in the RX path.
What is a use-after-free vulnerability in CVE-2026-31501?
A use-after-free vulnerability in CVE-2026-31501 occurs when the software continues to reference a memory location after it has been freed, potentially leading to memory corruption.
Is CVE-2026-31501 being actively exploited?
As of now, there is no known active exploitation of CVE-2026-31501 in the wild, but it is important to apply patches promptly.