CVE-2026-31656: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31656 is a race condition vulnerability in the Linux kernel's i915 GPU driver (Intel integrated graphics) that causes a use-after-free and reference count underflow in the intel_engine_park_heartbeat function. It affects Linux kernel versions 5.5 through 5.15.202, 5.16 through 6.1.168, 6.2 through 6.6.134, 6.7 through 6.12.81, 6.13 through 6.18.22, 6.19 through 6.19.12, and 7.0 release candidates (rc1–rc7). The vulnerability was disclosed on April 24, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper update of a reference count (CWE-911) combined with an integer underflow/wraparound (CWE-191) arising from a time-of-check/time-of-use race condition. The heartbeat worker reads engine->heartbeat.systole and calls i915_request_put() when a request completes, but clears the pointer in a separate, non-atomic step. Concurrently, request retirement on another CPU can drop the engine wakeref to zero, triggering __engine_park() → intel_engine_park_heartbeat(); if the heartbeat timer is still pending, cancel_delayed_work() returns true and the park function reads the stale non-NULL systole pointer and calls i915_request_put() a second time, causing a refcount underflow. The fix replaces the non-atomic read-then-clear sequence with an atomic xchg() instruction in both racing code paths, ensuring only one caller obtains the non-NULL pointer (Red Hat Bugzilla).

Successful exploitation causes a kernel reference count underflow leading to memory corruption and kernel panic, resulting in a denial of service (system crash). Because the vulnerability resides in kernel space, it can destabilize the entire system rather than a single process. Confidentiality and integrity impacts are also rated High in the CVSS scoring, reflecting the potential for memory corruption to be leveraged beyond a simple crash in certain scenarios, though the primary observed consequence is availability loss (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., a regular user account on a system with an Intel i915 GPU) and a specific timing condition between concurrent kernel threads, making reliable exploitation non-trivial. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

• Logs: Kernel log entries (dmesg/journalctl) containing refcount_warn_saturate warnings; stack traces referencing intel_engine_park_heartbeat, __engine_park, ____intel_wakeref_put_last, or i915_request_retire in the i915 module.
• System Behavior: Unexpected kernel panics or system reboots on hosts with Intel integrated graphics (i915 driver loaded); crash dumps (/var/crash/ or kdump output) showing call traces through the i915 workqueue (i915-unordered).
• Process: Anomalous behavior in the i915-unordered workqueue thread visible via kernel tracing tools such as perf or ftrace (Red Hat Bugzilla).

Apply kernel updates to the following fixed versions: 5.15.203+, 6.1.169+, 6.6.135+, 6.12.82+, 6.18.23+, or 6.19.13+. Patches are available in the kernel.org stable git repositories and have been incorporated into vendor distributions including Amazon Linux 2 (ALAS2KERNEL-5.15-2026-102) and SUSE (SUSE-SU-2026:2111-1, SUSE-SU-2026:2195-1, SUSE-SU-2026:2215-1, SUSE-SU-2026:2238-1). No configuration-based workaround is available; upgrading to a patched kernel is the only remediation. Systems without Intel i915 GPU hardware or with the i915 module unloaded are not affected (Red Hat Bugzilla, SUSE Advisory, Amazon Linux Advisory).

The vulnerability was announced via the official Linux kernel CVE mailing list (linux-cve-announce) on April 24, 2026. SUSE and Amazon Linux issued security advisories incorporating the fix. Coverage has been limited to standard vulnerability tracking outlets (CVEfeed, VulDB, Tenable plugin updates), with no notable independent researcher commentary or significant social media discussion observed (Linux Kernel CVE Announce).