CVE-2026-31646
- Source
- https://cve.org/CVERecord?id=CVE-2026-31646
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31646.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-31646
- Downstream
- Published
- 2026-04-24T14:44:59.874Z
- Modified
- 2026-05-18T05:57:41.860096481Z
- Summary
- net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: lan966x: fix pagepool error handling in lan966xfdmarxallocpagepool()
pagepoolcreate() can return an ERRPTR on failure. The return value is used unconditionally in the loop that follows, passing the error pointer through xdprxqinforegmemmodel() into pagepoolusexdpmem(), which dereferences it, causing a kernel oops.
Add an ISERR check after pagepool_create() to return early on failure.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31646.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/305832c53551cfbe6e5b81ca7ee765e60f4fe8e9
- https://git.kernel.org/stable/c/3fd0da4fd8851a7e62d009b7db6c4a05b092bc19
- https://git.kernel.org/stable/c/7caf90d9ab97951a58d1de85ab7e7d7cca7a4513
- https://git.kernel.org/stable/c/b5dcb41ba891b55157006cac79825c78a32b409e
- https://git.kernel.org/stable/c/e63265f188ea39dcf5f546770650027528f3bd0f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31646.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31646
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced11871aba19748b3387e83a2db6360aa7119e9a1aFixede63265f188ea39dcf5f546770650027528f3bd0fFixed305832c53551cfbe6e5b81ca7ee765e60f4fe8e9Fixedb5dcb41ba891b55157006cac79825c78a32b409eFixed7caf90d9ab97951a58d1de85ab7e7d7cca7a4513Fixed3fd0da4fd8851a7e62d009b7db6c4a05b092bc19