CVE-2026-31436

In the llist_abort_desc() function, the variable d serves as a cursor for iterating through the flist, however the code incorrectly calls completion on the variable found instead of on d. In the final list_for_each_entry_safe() loop, this causes an incorrect descriptor to be completed. This results in an inconsistent internal state of the DMA driver.

An attacker or malfunctioning code can lead to NULL pointer dereference, double completion of a descriptor, or resource leak, which in practice can result in system crash (kernel panic) or instability.

Apply patches available from the vendor according to the references — specific fix commits are available at the addresses provided in the references section (git.kernel.org)

Linux kernel with dmaengine/idxd subsystem — versions indicated in the vendor references (commits in stable branches of the kernel.org repository)