CVE-2026-31750 Details
Description
In the Linux kernel, the following vulnerability has been resolved: comedi: runflags cannot determine whether to reclaim chanlist syzbot reported a memory leak [1], because commit 4e1da516debb ("comedi: Add reference counting for Comedi command handling") did not consider the exceptional exit case in do_cmd_ioctl() where runflags is not set. This caused chanlist not to be properly freed by do_become_nonbusy(), as it only frees chanlist when runflags is correctly set. Added a check in do_become_nonbusy() for the case where runflags is not set, to properly free the chanlist memory. [1] BUG: memory leak backtrace (crc 844a0efa): __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline] do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890 do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]
A memory leak vulnerability has been identified in the Linux kernel's Comedi subsystem. This issue arises from improper handling of command references, which can lead to memory not being freed correctly. The vulnerability is present in the Linux kernel stable tree, specifically in versions that include the problematic commit 4e1da516debb. The memory leak occurs because the 'runflags' variable does not always indicate when to reclaim the 'chanlist' memory. As a result, 'do_become_nonbusy()' fails to free the 'chanlist' properly, leading to a memory leak.
Users can upgrade to the latest version of the Linux kernel stable tree to address this vulnerability. The specific commit that resolves the issue is 29f644f14b89e6c4965e3c89251929e451190a66.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/29f644f14b89e6c4965e3c89251929e451190a66 | kernel.org | Patch |
| https://git.kernel.org/stable/c/830c848aba9f047eb6b34288975ebeb8e8621451 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | kernel.org |