CVE-2026-31594

PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown

State: Published
Severity: Not scored
Published: Apr 24, 2026
Updated: Jun 14, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown

epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to perform later. This leads to an oops when .allow_link fails or when .drop_link is performed. The following is an example oops of the former case:

Unable to handle kernel paging request at virtual address dead000000000108 [...] [dead000000000108] address between user and kernel address ranges Internal error: Oops: 0000000096000044 [#1] SMP [...] Call trace: pci_epc_remove_epf+0x78/0xe0 (P) pci_primary_epc_epf_link+0x88/0xa8 configfs_symlink+0x1f4/0x5a0 vfs_symlink+0x134/0x1d8 do_symlinkat+0x88/0x138 __arm64_sys_symlinkat+0x74/0xe0 [...]

Remove the helper, and drop pci_epc_put(). EPC device refcounting is tied to the configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e2b6ef72b7aea9d7d480d2df499bcd1c93247abb to before 305a0674bc552bfcc3231e23fb91cf4f62aec168Affected e35f56bb03304abc92c928b641af41ca372966bb to before b261027a1a235d8925e332363f23135a0eff2b35Affected e35f56bb03304abc92c928b641af41ca372966bb to before e238ab12556b00f3b4d8b870b32ba1e4f4d4ebc2Affected e35f56bb03304abc92c928b641af41ca372966bb to before 73bf218de28d039126dc64281d2b47dd3c46a0a3Affected e35f56bb03304abc92c928b641af41ca372966bb to before cec9ead73ab154a7953f6ab8dd5127e0d6bbf95aAffected e35f56bb03304abc92c928b641af41ca372966bb to before 478e776101592eb63298714e96823ef78a3295ecAffected e35f56bb03304abc92c928b641af41ca372966bb to before a7a3cab4d33fd8a8aed864c447d0d7c99e85404eAffected e35f56bb03304abc92c928b641af41ca372966bb to before 0da63230d3ec1ec5fcc443a2314233e95bfece54Affected 5.15.153 to before 5.15.209Affected
LinuxLinux	6.0Affected before 6.0Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.84 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0.1 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

e2b6ef72b7aea9d7d480d2df499bcd1c93247abb to before 305a0674bc552bfcc3231e23fb91cf4f62aec168Affected
e35f56bb03304abc92c928b641af41ca372966bb to before b261027a1a235d8925e332363f23135a0eff2b35Affected
e35f56bb03304abc92c928b641af41ca372966bb to before e238ab12556b00f3b4d8b870b32ba1e4f4d4ebc2Affected
e35f56bb03304abc92c928b641af41ca372966bb to before 73bf218de28d039126dc64281d2b47dd3c46a0a3Affected
e35f56bb03304abc92c928b641af41ca372966bb to before cec9ead73ab154a7953f6ab8dd5127e0d6bbf95aAffected
e35f56bb03304abc92c928b641af41ca372966bb to before 478e776101592eb63298714e96823ef78a3295ecAffected
e35f56bb03304abc92c928b641af41ca372966bb to before a7a3cab4d33fd8a8aed864c447d0d7c99e85404eAffected
e35f56bb03304abc92c928b641af41ca372966bb to before 0da63230d3ec1ec5fcc443a2314233e95bfece54Affected
5.15.153 to before 5.15.209Affected

LinuxLinux

6.0Affected
before 6.0Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.84 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0.1 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.