CVE-2026-31501
published 2026-04-22CVE-2026-31501: In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path…
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.38%
30.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.
In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is
freed via k3_cppi_desc_pool_free() before the psdata pointer is used
by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].
This constitutes a use-after-free on every received packet that goes
through the timestamp path.
Defer the descriptor free until after all accesses through the psdata
pointer are complete. For emac_rx_packet(), move the free into the
requeue label so both early-exit and success paths free the descriptor
after all accesses are done. For emac_rx_packet_zc(), move the free to
the end of the loop body after emac_dispatch_skb_zc() (which calls
emac_rx_timestamp()) has returned.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86 < d5827316debcb677679bb014885d7be92c410e11 | d5827316debcb677679bb014885d7be92c410e11 |
| linux | linux | >= 46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86 < eb8c426c9803beb171f89d15fea17505eb517714 | eb8c426c9803beb171f89d15fea17505eb517714 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.15.1 < 6.19.11 | 6.19.11 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.19.10 cppi5_hdesc_get_psdata use after free (Nessus ID 310639)
vuldb·2026-04-28
CVE-2026-31501 [CRITICAL] Linux Kernel up to 6.19.10 cppi5_hdesc_get_psdata use after free (Nessus ID 310639)
A vulnerability has been found in Linux Kernel up to 6.19.10 and classified as critical. Impacted is the function cppi5_hdesc_get_psdata. Performing a manipulation results in use after free.
This vulnerability is known as CVE-2026-31501. Access to the local network is required for this attack. No exploit is available.
The affected component should be upgraded.
GHSA
GHSA-6xxj-984x-2f74: In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
cppi5_hd
ghsa_unreviewed·2026-04-22
CVE-2026-31501 GHSA-6xxj-984x-2f74: In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
cppi5_hd
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.
In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is
freed via k3_cppi_desc_pool_free() before the psdata pointer is used
by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].
This constitutes a use-after-free on every received packet that goes
through the timestamp path.
Defer the descriptor free until after all accesses through the psdata
pointer are complete. For emac_rx_packet(), move the free into the
requeue label so both early-exit and success paths free the descriptor
after all accesses are done. For emac_rx_packet_zc(), move the free to
the end
Red Hat
kernel: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
vendor_redhat·2026-04-22
CVE-2026-31501 CWE-825 kernel: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
kernel: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
A flaw was found in the Linux kernel's `net: ti: icssg-prueth` driver. This use-after-free vulnerability occurs in the receive (RX) path, where a data structure (CPPI descriptor) is released from memory before all necessary operations on its contents are complete. A remote attacker could exploit this by sending specially crafted network packets, potentially leading to memory corruption and system instability or denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-31501 kernel: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
bugzilla·2026-04-22
CVE-2026-31501 CVE-2026-31501 kernel: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
CVE-2026-31501 kernel: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.
In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is
freed via k3_cppi_desc_pool_free() before the psdata pointer is used
by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].
This constitutes a use-after-free on every received packet that goes
through the timestamp path.
Defer the descriptor free until after all accesses through the psdata
pointer are complete. For emac_rx_packet(), move the free into the
requeue label so both early-exit and success paths fr
Bugzilla
CVE-2025-31501 rt: From CVEorg collector [fedora-42]
bugzilla·2025-05-28·CVSS 6.1
CVE-2025-31501 [MEDIUM] CVE-2025-31501 rt: From CVEorg collector [fedora-42]
CVE-2025-31501 rt: From CVEorg collector [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2369046
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for
2026-04-22
Published