Linux kernel idxd: stale saved-config pointer after a failed second FLR allows invalid memory access

Impact

In the idxd driver for Intel Data Streaming Accelerator devices, the scratch area holding the saved configuration was freed without being set to NULL, so if a first Function Level Reset completes and a second FLR then fails to allocate the scratch area, the driver can access the stale pointer. The exposure is narrow - it needs two FLRs with an allocation failure in between, and FLR is an administrative operation on the host - but the consequence is invalid memory access in the host kernel, which on a server where DSA is used for memory-move offload or exposed to guests via VFIO means a crash during device reset. The record gives no evidence of a tenant-reachable path.

Who can reach it

Local and privileged: triggering FLR on the idxd device requires root on the host (or the hypervisor-side reset path for an assigned device). Not reachable by an unprivileged tenant; realistically hit during device reset or driver recovery under memory pressure.

What to do

Update the host kernel to a build carrying the stable fix commits below and reboot the affected nodes; the fix simply NULLs the scratch pointer after FLR. Only hosts whose Intel accelerator devices are driven by idxd are affected, and the window is a reset operation, so this can ride along with the next scheduled kernel reboot rather than an emergency one.

References

Related entries

• Linux kernel (drivers/vfio/pci): The error path of the vfio-pci dma-buf export falls through the whole unwind chainCVE-2026-31468 · Linux kernel (drivers/vfio/pci)High
• Linux kernel (net/smc): Tee(2) duplicates an SMC splice pipe buffer without duplicating the private state hanging offCVE-2026-31507 · Linux kernel (net/smc)High
• Linux kernel (net/xfrm): An XFRM_MSG_NEWSPDINFO request queues a per-namespace work item on the global systemCVE-2026-31516 · Linux kernel (net/xfrm)High
• Linux kernel BPF: signed 32-bit div/mod of S32_MIN diverges from the verifier, allowing out-of-bounds map accessCVE-2026-31525 · Linux kernel BPF interpreter (sdiv32/smod32 abs() on S32_MIN)High
• Linux kernel perf: wrong PMU's transaction handlers on software-leader groups cause out-of-bounds accessCVE-2026-31528 · Linux kernel perf core (event group PMU context, inherit and __perf_event_read)High
• Linux kernel blk-cgroup: use-after-free on cgroup writeback release when the last blkcg reference dropsCVE-2026-31586 · Linux kernel blk-cgroup (cgwb_release_workfn / blkcg_unpin_online)High