{"id":"AZL-83777","summary":"CVE-2026-31594 affecting package kernel for versions less than 6.6.137.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown\n\nepf_ntb_epc_destroy() duplicates the teardown that the caller is\nsupposed to perform later. This leads to an oops when .allow_link fails\nor when .drop_link is performed. The following is an example oops of the\nformer case:\n\n  Unable to handle kernel paging request at virtual address dead000000000108\n  [...]\n  [dead000000000108] address between user and kernel address ranges\n  Internal error: Oops: 0000000096000044 [#1]  SMP\n  [...]\n  Call trace:\n   pci_epc_remove_epf+0x78/0xe0 (P)\n   pci_primary_epc_epf_link+0x88/0xa8\n   configfs_symlink+0x1f4/0x5a0\n   vfs_symlink+0x134/0x1d8\n   do_symlinkat+0x88/0x138\n   __arm64_sys_symlinkat+0x74/0xe0\n  [...]\n\nRemove the helper, and drop pci_epc_put(). EPC device refcounting is\ntied to the configfs EPC group lifetime, and pci_epc_put() in the\n.drop_link path is sufficient.","modified":"2026-08-28T17:47:57.270801863Z","published":"2026-04-24T15:16:37Z","upstream":["CVE-2026-31594"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31594"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.137.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-83777.json"}}],"schema_version":"1.9.0"}