CVE-2026-31594

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown

epf_ntb_epc_destroy() duplicates the teardown that the caller is

supposed to perform later. This leads to an oops when .allow_link fails

or when .drop_link is performed. The following is an example oops of the

former case:

Unable to handle kernel paging request at virtual address dead000000000108

[...]

[dead000000000108] address between user and kernel address ranges

Internal error: Oops: 0000000096000044 [#1] SMP

[...]

Call trace:

pci_epc_remove_epf+0x78/0xe0 (P)

pci_primary_epc_epf_link+0x88/0xa8

configfs_symlink+0x1f4/0x5a0

vfs_symlink+0x134/0x1d8

do_symlinkat+0x88/0x138

__arm64_sys_symlinkat+0x74/0xe0

[...]

Remove the helper, and drop pci_epc_put(). EPC device refcounting is

tied to the configfs EPC group lifetime, and pci_epc_put() in the

.drop_link path is sufficient.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References