{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/comedi_fops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "830c848aba9f047eb6b34288975ebeb8e8621451",
              "status": "affected",
              "version": "4e1da516debbe6a573ffa0392e2809d180d0575c",
              "versionType": "git"
            },
            {
              "lessThan": "29f644f14b89e6c4965e3c89251929e451190a66",
              "status": "affected",
              "version": "4e1da516debbe6a573ffa0392e2809d180d0575c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/comedi_fops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: runflags cannot determine whether to reclaim chanlist\n\nsyzbot reported a memory leak [1], because commit 4e1da516debb (\"comedi:\nAdd reference counting for Comedi command handling\") did not consider\nthe exceptional exit case in do_cmd_ioctl() where runflags is not set.\nThis caused chanlist not to be properly freed by do_become_nonbusy(),\nas it only frees chanlist when runflags is correctly set.\n\nAdded a check in do_become_nonbusy() for the case where runflags is not\nset, to properly free the chanlist memory.\n\n[1]\nBUG: memory leak\n  backtrace (crc 844a0efa):\n    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]\n    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890\n    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-01T14:14:42.887Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/830c848aba9f047eb6b34288975ebeb8e8621451"
        },
        {
          "url": "https://git.kernel.org/stable/c/29f644f14b89e6c4965e3c89251929e451190a66"
        }
      ],
      "title": "comedi: runflags cannot determine whether to reclaim chanlist",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31750",
    "datePublished": "2026-05-01T14:14:42.887Z",
    "dateReserved": "2026-03-09T15:48:24.139Z",
    "dateUpdated": "2026-05-01T14:14:42.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31750",
      "date": "2026-05-05",
      "epss": "0.00018",
      "percentile": "0.04977"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31750\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T15:16:37.850\",\"lastModified\":\"2026-05-01T15:24:14.893\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncomedi: runflags cannot determine whether to reclaim chanlist\\n\\nsyzbot reported a memory leak [1], because commit 4e1da516debb (\\\"comedi:\\nAdd reference counting for Comedi command handling\\\") did not consider\\nthe exceptional exit case in do_cmd_ioctl() where runflags is not set.\\nThis caused chanlist not to be properly freed by do_become_nonbusy(),\\nas it only frees chanlist when runflags is correctly set.\\n\\nAdded a check in do_become_nonbusy() for the case where runflags is not\\nset, to properly free the chanlist memory.\\n\\n[1]\\nBUG: memory leak\\n  backtrace (crc 844a0efa):\\n    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]\\n    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890\\n    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29f644f14b89e6c4965e3c89251929e451190a66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/830c848aba9f047eb6b34288975ebeb8e8621451\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}