GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31656 (GCVE-0-2026-31656)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:45 – Updated: 2026-08-05 12:24
VLAI
Title
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat A use-after-free / refcount underflow is possible when the heartbeat worker and intel_engine_park_heartbeat() race to release the same engine->heartbeat.systole request. The heartbeat worker reads engine->heartbeat.systole and calls i915_request_put() on it when the request is complete, but clears the pointer in a separate, non-atomic step. Concurrently, a request retirement on another CPU can drop the engine wakeref to zero, triggering __engine_park() -> intel_engine_park_heartbeat(). If the heartbeat timer is pending at that point, cancel_delayed_work() returns true and intel_engine_park_heartbeat() reads the stale non-NULL systole pointer and calls i915_request_put() on it again, causing a refcount underflow: ``` <4> [487.221889] Workqueue: i915-unordered engine_retire [i915] <4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0 ... <4> [487.222707] Call Trace: <4> [487.222711] <TASK> <4> [487.222716] intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915] <4> [487.223115] intel_engine_park_heartbeat+0x25/0x40 [i915] <4> [487.223566] __engine_park+0xb9/0x650 [i915] <4> [487.223973] ____intel_wakeref_put_last+0x2e/0xb0 [i915] <4> [487.224408] __intel_wakeref_put_last+0x72/0x90 [i915] <4> [487.224797] intel_context_exit_engine+0x7c/0x80 [i915] <4> [487.225238] intel_context_exit+0xf1/0x1b0 [i915] <4> [487.225695] i915_request_retire.part.0+0x1b9/0x530 [i915] <4> [487.226178] i915_request_retire+0x1c/0x40 [i915] <4> [487.226625] engine_retire+0x122/0x180 [i915] <4> [487.227037] process_one_work+0x239/0x760 <4> [487.227060] worker_thread+0x200/0x3f0 <4> [487.227068] ? __pfx_worker_thread+0x10/0x10 <4> [487.227075] kthread+0x10d/0x150 <4> [487.227083] ? __pfx_kthread+0x10/0x10 <4> [487.227092] ret_from_fork+0x3d4/0x480 <4> [487.227099] ? __pfx_kthread+0x10/0x10 <4> [487.227107] ret_from_fork_asm+0x1a/0x30 <4> [487.227141] </TASK> ``` Fix this by replacing the non-atomic pointer read + separate clear with xchg() in both racing paths. xchg() is a single indivisible hardware instruction that atomically reads the old pointer and writes NULL. This guarantees only one of the two concurrent callers obtains the non-NULL pointer and performs the put, the other gets NULL and skips it. (cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < 82034799c6c14b3104668878c3f3e5786f777126 (git)
Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < 70d3e622b10092fc483e28e57b4e8c49d9cc7f68 (git)
Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < 8ce44d28a84fd5e053a88b04872a89d95c0779d4 (git)
Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < ca3f48c3567dd49efdc55b80029ae74659c682ee (git)
Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < a00e92bf6583d019a4fb2c2df7007e6c9b269ce7 (git)
Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < 2af8b200cae3fdd0e917ecc2753b28bb40c876c1 (git)
Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < 455d98ed527fc94eed90406f90ab2391464ca657 (git)
Affected: 058179e72e0956a2dfe4927db6cbe5fbfb2406aa , < 4c71fd099513bfa8acab529b626e1f0097b76061 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.169 , ≤ 6.1.* (semver)
Unaffected: 6.6.135 , ≤ 6.6.* (semver)
Unaffected: 6.12.82 , ≤ 6.12.* (semver)
Unaffected: 6.18.23 , ≤ 6.18.* (semver)
Unaffected: 6.19.13 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "82034799c6c14b3104668878c3f3e5786f777126",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            },
            {
              "lessThan": "70d3e622b10092fc483e28e57b4e8c49d9cc7f68",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            },
            {
              "lessThan": "8ce44d28a84fd5e053a88b04872a89d95c0779d4",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            },
            {
              "lessThan": "ca3f48c3567dd49efdc55b80029ae74659c682ee",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            },
            {
              "lessThan": "a00e92bf6583d019a4fb2c2df7007e6c9b269ce7",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            },
            {
              "lessThan": "2af8b200cae3fdd0e917ecc2753b28bb40c876c1",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            },
            {
              "lessThan": "455d98ed527fc94eed90406f90ab2391464ca657",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            },
            {
              "lessThan": "4c71fd099513bfa8acab529b626e1f0097b76061",
              "status": "affected",
              "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat\n\nA use-after-free / refcount underflow is possible when the heartbeat\nworker and intel_engine_park_heartbeat() race to release the same\nengine-\u003eheartbeat.systole request.\n\nThe heartbeat worker reads engine-\u003eheartbeat.systole and calls\ni915_request_put() on it when the request is complete, but clears\nthe pointer in a separate, non-atomic step. Concurrently, a request\nretirement on another CPU can drop the engine wakeref to zero, triggering\n__engine_park() -\u003e intel_engine_park_heartbeat(). If the heartbeat\ntimer is pending at that point, cancel_delayed_work() returns true and\nintel_engine_park_heartbeat() reads the stale non-NULL systole pointer\nand calls i915_request_put() on it again, causing a refcount underflow:\n\n```\n\u003c4\u003e [487.221889] Workqueue: i915-unordered engine_retire [i915]\n\u003c4\u003e [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n...\n\u003c4\u003e [487.222707] Call Trace:\n\u003c4\u003e [487.222711]  \u003cTASK\u003e\n\u003c4\u003e [487.222716]  intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]\n\u003c4\u003e [487.223115]  intel_engine_park_heartbeat+0x25/0x40 [i915]\n\u003c4\u003e [487.223566]  __engine_park+0xb9/0x650 [i915]\n\u003c4\u003e [487.223973]  ____intel_wakeref_put_last+0x2e/0xb0 [i915]\n\u003c4\u003e [487.224408]  __intel_wakeref_put_last+0x72/0x90 [i915]\n\u003c4\u003e [487.224797]  intel_context_exit_engine+0x7c/0x80 [i915]\n\u003c4\u003e [487.225238]  intel_context_exit+0xf1/0x1b0 [i915]\n\u003c4\u003e [487.225695]  i915_request_retire.part.0+0x1b9/0x530 [i915]\n\u003c4\u003e [487.226178]  i915_request_retire+0x1c/0x40 [i915]\n\u003c4\u003e [487.226625]  engine_retire+0x122/0x180 [i915]\n\u003c4\u003e [487.227037]  process_one_work+0x239/0x760\n\u003c4\u003e [487.227060]  worker_thread+0x200/0x3f0\n\u003c4\u003e [487.227068]  ? __pfx_worker_thread+0x10/0x10\n\u003c4\u003e [487.227075]  kthread+0x10d/0x150\n\u003c4\u003e [487.227083]  ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [487.227092]  ret_from_fork+0x3d4/0x480\n\u003c4\u003e [487.227099]  ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [487.227107]  ret_from_fork_asm+0x1a/0x30\n\u003c4\u003e [487.227141]  \u003c/TASK\u003e\n```\n\nFix this by replacing the non-atomic pointer read + separate clear with\nxchg() in both racing paths. xchg() is a single indivisible hardware\ninstruction that atomically reads the old pointer and writes NULL. This\nguarantees only one of the two concurrent callers obtains the non-NULL\npointer and performs the put, the other gets NULL and skips it.\n\n(cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached locally through i915 DRM render ioctls such as execbuffer submission, not through network or adjacent protocols.\nAC:L - Although the bug is a race, an attacker with render access can repeatedly drive GPU request submission, heartbeat creation, completion, retirement, and engine parking to trigger it.\nPR:L - The relevant ioctl is DRM_RENDER_ALLOW and does not require CAP_SYS_ADMIN or DRM master, but the attacker needs local access to an i915 render device as an unprivileged render client.\nUI:N - No victim action is required once the attacker can issue DRM ioctls and submit GPU work.\nS:U - The impact remains within the kernel/driver security authority; this is not a VM escape or cross-scope boundary bypass.\nC:H - The stale i915_request pointer can become a use-after-free on a reused request object, and per the required kernel scoring guidance UAFs are treated as enabling high confidentiality impact.\nI:H - The double put/refcount underflow can corrupt request/fence lifetime state and create a UAF condition, which is defensibly exploitable for arbitrary kernel memory manipulation.\nA:H - The observed failure reaches refcount_warn_saturate from the engine park path and can produce a kernel warning/oops or crash; repeated triggering can deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:09.663Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/82034799c6c14b3104668878c3f3e5786f777126"
        },
        {
          "url": "https://git.kernel.org/stable/c/70d3e622b10092fc483e28e57b4e8c49d9cc7f68"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ce44d28a84fd5e053a88b04872a89d95c0779d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca3f48c3567dd49efdc55b80029ae74659c682ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/a00e92bf6583d019a4fb2c2df7007e6c9b269ce7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2af8b200cae3fdd0e917ecc2753b28bb40c876c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/455d98ed527fc94eed90406f90ab2391464ca657"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c71fd099513bfa8acab529b626e1f0097b76061"
        }
      ],
      "title": "drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31656",
    "datePublished": "2026-04-24T14:45:07.738Z",
    "dateReserved": "2026-03-09T15:48:24.129Z",
    "dateUpdated": "2026-08-05T12:24:09.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31656",
      "date": "2026-09-19",
      "epss": "0.00117",
      "percentile": "0.01893"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-01T14:44:56.000Z",
      "cve": "CVE-2026-31656",
      "id": "msrc_CVE-2026-31656",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31656.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "82034799c6c14b3104668878c3f3e5786f777126",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "70d3e622b10092fc483e28e57b4e8c49d9cc7f68",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8ce44d28a84fd5e053a88b04872a89d95c0779d4",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ca3f48c3567dd49efdc55b80029ae74659c682ee",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a00e92bf6583d019a4fb2c2df7007e6c9b269ce7",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2af8b200cae3fdd0e917ecc2753b28bb40c876c1",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "455d98ed527fc94eed90406f90ab2391464ca657",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c71fd099513bfa8acab529b626e1f0097b76061",
                    "status": "affected",
                    "version": "058179e72e0956a2dfe4927db6cbe5fbfb2406aa",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.203",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.169",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.135",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.82",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A1B622D-B57C-432F-A03B-40A25B6C1E06",
                    "versionEndExcluding": "5.15.203",
                    "versionStartIncluding": "5.5.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DBEC0E5D-641C-4E98-A6D9-5799B10CE451",
                    "versionEndExcluding": "6.1.169",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15C1A1B2-14EE-494C-AF3E-D5A7BA640B39",
                    "versionEndExcluding": "6.6.135",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "02904CAE-71D2-45B3-9EC3-F6A9D18B6307",
                    "versionEndExcluding": "6.12.82",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F",
                    "versionEndExcluding": "6.18.23",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4",
                    "versionEndExcluding": "6.19.13",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*",
                    "matchCriteriaId": "EE98F46A-F7D9-4609-B6A0-882E7F0D378C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat\n\nA use-after-free / refcount underflow is possible when the heartbeat\nworker and intel_engine_park_heartbeat() race to release the same\nengine-\u003eheartbeat.systole request.\n\nThe heartbeat worker reads engine-\u003eheartbeat.systole and calls\ni915_request_put() on it when the request is complete, but clears\nthe pointer in a separate, non-atomic step. Concurrently, a request\nretirement on another CPU can drop the engine wakeref to zero, triggering\n__engine_park() -\u003e intel_engine_park_heartbeat(). If the heartbeat\ntimer is pending at that point, cancel_delayed_work() returns true and\nintel_engine_park_heartbeat() reads the stale non-NULL systole pointer\nand calls i915_request_put() on it again, causing a refcount underflow:\n\n```\n\u003c4\u003e [487.221889] Workqueue: i915-unordered engine_retire [i915]\n\u003c4\u003e [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n...\n\u003c4\u003e [487.222707] Call Trace:\n\u003c4\u003e [487.222711]  \u003cTASK\u003e\n\u003c4\u003e [487.222716]  intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]\n\u003c4\u003e [487.223115]  intel_engine_park_heartbeat+0x25/0x40 [i915]\n\u003c4\u003e [487.223566]  __engine_park+0xb9/0x650 [i915]\n\u003c4\u003e [487.223973]  ____intel_wakeref_put_last+0x2e/0xb0 [i915]\n\u003c4\u003e [487.224408]  __intel_wakeref_put_last+0x72/0x90 [i915]\n\u003c4\u003e [487.224797]  intel_context_exit_engine+0x7c/0x80 [i915]\n\u003c4\u003e [487.225238]  intel_context_exit+0xf1/0x1b0 [i915]\n\u003c4\u003e [487.225695]  i915_request_retire.part.0+0x1b9/0x530 [i915]\n\u003c4\u003e [487.226178]  i915_request_retire+0x1c/0x40 [i915]\n\u003c4\u003e [487.226625]  engine_retire+0x122/0x180 [i915]\n\u003c4\u003e [487.227037]  process_one_work+0x239/0x760\n\u003c4\u003e [487.227060]  worker_thread+0x200/0x3f0\n\u003c4\u003e [487.227068]  ? __pfx_worker_thread+0x10/0x10\n\u003c4\u003e [487.227075]  kthread+0x10d/0x150\n\u003c4\u003e [487.227083]  ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [487.227092]  ret_from_fork+0x3d4/0x480\n\u003c4\u003e [487.227099]  ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [487.227107]  ret_from_fork_asm+0x1a/0x30\n\u003c4\u003e [487.227141]  \u003c/TASK\u003e\n```\n\nFix this by replacing the non-atomic pointer read + separate clear with\nxchg() in both racing paths. xchg() is a single indivisible hardware\ninstruction that atomically reads the old pointer and writes NULL. This\nguarantees only one of the two concurrent callers obtains the non-NULL\npointer and performs the put, the other gets NULL and skips it.\n\n(cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)"
          }
        ],
        "id": "CVE-2026-31656",
        "lastModified": "2026-06-17T10:34:10.567",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-24T15:16:45.097",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2af8b200cae3fdd0e917ecc2753b28bb40c876c1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/455d98ed527fc94eed90406f90ab2391464ca657"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4c71fd099513bfa8acab529b626e1f0097b76061"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/70d3e622b10092fc483e28e57b4e8c49d9cc7f68"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/82034799c6c14b3104668878c3f3e5786f777126"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8ce44d28a84fd5e053a88b04872a89d95c0779d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a00e92bf6583d019a4fb2c2df7007e6c9b269ce7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ca3f48c3567dd49efdc55b80029ae74659c682ee"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-191"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T11:38:51+00:00",
      "cve": "CVE-2026-31656",
      "id": "CVE-2026-31656",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31656.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-21T01:14:16Z",
      "cve": "CVE-2026-31656",
      "id": "CVE-2026-31656",
      "initial_release_date": "2026-04-25T01:36:52Z",
      "product_status:first_fixed": "55",
      "product_status:known_affected": "413",
      "product_status:known_not_affected": "94",
      "product_status:recommended": "404",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31656",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31656.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.