LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31501: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path. Defer the descriptor free until after all accesses through the psdata pointer are complete. For emac_rx_packet(), move the free into the requeue label so both early-exit and success paths free the descriptor after all accesses are done. For emac_rx_packet_zc(), move the free to the end of the loop body after emac_dispatch_skb_zc() (which calls emac_rx_timestamp()) has returned.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux network driver for certain Texas Instruments ICSSG PRU Ethernet hardware can access memory after releasing it while processing timestamped traffic. This can corrupt the kernel or cause crashes. The supplied CVSS rating is 9.8, but the bundle does not establish practical compromise or active exploitation.

Executive priority

Treat as an urgent, hardware-scoped kernel update. Identify systems using the affected TI Ethernet driver first, then patch according to vendor guidance. Critical scoring supports rapid action, but there is no supplied evidence of active exploitation, and systems without this driver are unlikely to be exposed.

Technical view

In emac_rx_packet() and emac_rx_packet_zc(), the driver frees a CPPI descriptor before emac_rx_timestamp() dereferences psdata within that descriptor. The flaw occurs on received packets entering the timestamp path. The published fix delays k3_cppi_desc_pool_free() until all psdata accesses and dispatch processing finish.

Likely exposure

Exposure appears limited to Linux systems using the TI ICSSG PRU Ethernet driver with the RX timestamp path active. The affected-version data names 6.15, 6.19.11, and 7.0 but contains an ambiguous "0" entry, so exact downstream distribution exposure requires vendor confirmation.

Exploitation context

The supplied record is not in KEV, and no cited source reports active exploitation or a public exploit. Although the CVSS vector claims network reachability and complete confidentiality, integrity, and availability impact, the bundle does not demonstrate those outcomes. The confirmed behavior is a kernel use-after-free during applicable packet reception.

Researcher notes

The record identifies a deterministic descriptor-lifetime error in two RX implementations. No CWE is assigned. The sources describe the correction but do not establish exploitability, attacker control over reclaimed memory, or reliable confidentiality and integrity impact. Version metadata is ambiguous, and downstream backports may change exposure independently of kernel version labels.

Mitigation direction

  • Apply the applicable stable-kernel fix containing one of the referenced corrective commits.
  • Check distribution or device-vendor advisories for fixed package and firmware versions.
  • Prioritize exposed systems using TI ICSSG PRU Ethernet hardware and receive timestamping.
  • If immediate patching is impossible, assess whether the affected driver or timestamp feature can be safely disabled.

Validation and detection

  • Inventory kernels and confirm whether the ti icssg-prueth driver is present and active.
  • Determine whether receive timestamping is enabled on affected interfaces.
  • Compare the running kernel source or vendor package against the referenced fixes.
  • Review kernel logs and monitoring for unexplained crashes or memory-corruption symptoms.
  • Confirm vendor-fixed packages are installed and the corrected kernel is running after reboot.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31501 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-31501Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86, 46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86unaffected
LinuxLinux6.15, 0, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.