CVE-2026-31594: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-31594 is a use-after-free/double-free vulnerability in the Linux kernel's PCI endpoint driver (pci-epf-vntb) that allows a low-privileged local attacker to trigger a kernel panic and denial of service. The flaw exists in the epf_ntb_epc_destroy() helper function, which duplicates resource teardown already performed by its caller, leading to kernel oops when .allow_link fails or .drop_link is invoked. Affected Linux kernel versions span 6.0 through 7.0.0, with fixes available in 6.6.136+, 6.12.84+, 6.18.24+, 6.19.14+, and 7.0.1+. It was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is a duplicate resource teardown in the epf_ntb_epc_destroy() function within the pci-epf-vntb PCI endpoint driver. When this helper is called, it frees resources (including calling pci_epc_put()) that the caller is expected to release later, resulting in a use-after-free condition. This manifests as a kernel oops with the error Unable to handle kernel paging request at virtual address dead000000000108 — a well-known Linux kernel poison value indicating access to already-freed memory. The call trace shows the crash originates from pci_epc_remove_epf triggered via configfs_symlink operations, meaning an attacker with access to configfs can reliably trigger the condition. The fix removes the epf_ntb_epc_destroy() helper entirely and relies solely on pci_epc_put() in the .drop_link path, as EPC device refcounting is tied to the configfs EPC group lifetime (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel panic (oops), resulting in a denial-of-service condition that crashes the affected system. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not expose data or allow code execution beyond crashing the kernel. The attack requires local access with low privileges, limiting the blast radius to systems where untrusted local users have access to configfs and PCI endpoint functionality (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.017% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to perform configfs symlink operations, which significantly limits the attack surface.

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing Unable to handle kernel paging request at virtual address dead000000000108 or Internal error: Oops: 0000000096000044.
• Logs: Kernel call trace referencing pci_epc_remove_epf, pci_primary_epc_epf_link, configfs_symlink, or vfs_symlink in close succession.
• Process: Unexpected system reboots or kernel panics on systems using PCI endpoint (EPF/EPC) functionality, particularly those with configfs-based PCI endpoint configuration.
• File System: Unusual or repeated symlink creation attempts under the configfs PCI endpoint group directories (typically under /sys/kernel/config/pci_ep/).

Apply the upstream kernel patches available for the following stable series: 6.6.136+ (6.6.x), 6.12.84+ (6.7–6.12.x), 6.18.24+ (6.13–6.18.x), 6.19.14+ (6.19.x), and 7.0.1+ (7.0.x) (Github Advisory). As a temporary workaround where immediate patching is not feasible, restrict configfs access to trusted users only to prevent low-privileged users from triggering the vulnerable code path. Linux distribution vendors (e.g., Red Hat) are tracking this issue and may release backported patches for their supported kernel versions (Red Hat Bugzilla).