{
  "cveId": "CVE-2026-31501",
  "url": "https://patchblox.com/security/cve/CVE-2026-31501",
  "summary": "CVE-2026-31501 is fixed in linux on 1 platform by DEBIAN-CVE-2026-31501 (version 6.19.11-1), released May 15, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: ti: icssg-prueth: fix use-after-free of CPP...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path  cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path.  Defer the descriptor free until after all accesses through the psdata pointer are complete. For emac_rx_packet(), move the free into the requeue label so both early-exit and success paths free the descriptor after all accesses are done. For emac_rx_packet_zc(), move the free to the end of the loop body after emac_dispatch_skb_zc() (which calls emac_rx_timestamp()) has returned.",
  "published": "2026-04-22T14:16:48Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.0043,
  "epssPercentile": 0.37463,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.19.11-1",
      "fix": "DEBIAN-CVE-2026-31501",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-31501",
      "released": "2026-05-15T16:01:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}