Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-31399: Linux Kernel: Use After Free in NVDIMM Initialization
CVE-2026-31399
Summary
A bug was found in the Linux kernel's non-volatile memory initialization process that could cause data to be accessed after it had been freed. This issue has been fixed, but it's essential to update your Linux kernel to ensure you have the latest security patches and prevent potential system crashes. Update your Linux kernel as soon as possible to apply this fix.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linux | linux_kernel |
>= 4.4.164, < 4.5 >= 4.9.137, < 4.10 >= 4.14.81, < 4.15 >= 4.18.19, < 4.19 >= 4.19.2, < 5.10.253 >= 5.11, < 5.15.203 >= 5.16, < 6.1.167 >= 6.2, < 6.6.130 >= 6.7, < 6.12.78 >= 6.13, < 6.18.20 >= 6.19, < 6.19.10 7.0 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
Original title
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/bus: Fix potential use after free in asynchronous initialization
Dingisoul with KASAN reports a use after free if device...
Original description
In the Linux kernel, the following vulnerability has been resolved:
nvdimm/bus: Fix potential use after free in asynchronous initialization
Dingisoul with KASAN reports a use after free if device_add() fails in
nd_async_device_register().
Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while
scheduling async init") correctly added a reference on the parent device
to be held until asynchronous initialization was complete. However, if
device_add() results in an allocation failure the ref count of the
device drops to 0 prior to the parent pointer being accessed. Thus
resulting in use after free.
The bug bot AI correctly identified the fix. Save a reference to the
parent pointer to be used to drop the parent reference regardless of the
outcome of device_add().
nvdimm/bus: Fix potential use after free in asynchronous initialization
Dingisoul with KASAN reports a use after free if device_add() fails in
nd_async_device_register().
Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while
scheduling async init") correctly added a reference on the parent device
to be held until asynchronous initialization was complete. However, if
device_add() results in an allocation failure the ref count of the
device drops to 0 prior to the parent pointer being accessed. Thus
resulting in use after free.
The bug bot AI correctly identified the fix. Save a reference to the
parent pointer to be used to drop the parent reference regardless of the
outcome of device_add().
Vulnerability type
CWE-416
Use After Free
- https://git.kernel.org/stable/c/2c638259ad750833fd46a0cf57672a618542d84c
- https://git.kernel.org/stable/c/6fc36c2a925ceaba203eb13d75a8f0879a2c121b
- https://git.kernel.org/stable/c/84af19855d1abdee3c9d57c0684e2868e391793c
- https://git.kernel.org/stable/c/9a0fb16ba5b372465a3a1ecd761c6fa911a4ab4d
- https://git.kernel.org/stable/c/a226e5b49e5fe8c98b14f8507de670189d191348
- https://git.kernel.org/stable/c/a36cf138500e56f50db9f9a33222df6969b38326
- https://git.kernel.org/stable/c/a8aec14230322ed8f1e8042b6d656c1631d41163
- https://git.kernel.org/stable/c/e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e
Published: 3 Apr 2026 · Updated: 15 Jun 2026 · First seen: 18 Apr 2026