Local kernel compromise via EFA completion use-after-free
Published Apr 22, 2026 · Updated Apr 22, 2026
Use-after-free in the Linux Kernel EFA RDMA driver allows local users to compromise the kernel through an admin command error. The polling or interrupt handler frees an admin completion context before the error path prints fields from it, so the code reads memory that can already hold new data. An affected system must run the EFA driver, and exploitation requires local low-privileged access; successful exploitation can expose or alter kernel memory or interrupt service.
Summary
What happened
Use-after-free in the Linux Kernel EFA RDMA driver allows local users to compromise the kernel through an admin command error. The polling or interrupt handler frees an admin completion context before the error path prints fields from it, so the code reads memory that can already hold new data. An affected system must run the EFA driver, and exploitation requires local low-privileged access; successful exploitation can expose or alter kernel memory or interrupt service.
The record
- CVE
- CVE-2026-31493
- Published
- Apr 22, 2026
- Updated
- Apr 22, 2026
- Vendor
- The Linux Kernel Organization
- Product
- Linux Kernel
- Classifications
- CWE-416, T1068
- Attack vector
- local
- Privileges
- authenticated
Timeline
How it unfolded
- Apr 22, 2026CVE publishedPublication date reported by the CVE source.
- Apr 22, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=5.12
- Affected versionversion=68fb9f3e312a36e49fd05ec2d6b668daf2c4931a <0dd98aea1c0c45987fa2dd92f988b0eb1a72c125
- Affected versionversion=68fb9f3e312a36e49fd05ec2d6b668daf2c4931a <1cf95fe5dc5471efea947b4c6f8913da6bc7976e
- Affected versionversion=68fb9f3e312a36e49fd05ec2d6b668daf2c4931a <ef3b06742c8a201d0e83edc9a33a89a4fe3009f8
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo