CVE-2026-31399

A flaw was found in the Linux kernel's nvdimm/bus component. During asynchronous device initialization, if the device_add() function fails in nd_async_device_register(), a use-after-free vulnerability can occur. This happens because the device's reference count drops to zero before the parent pointer is accessed, leading to memory corruption. A local attacker could potentially exploit this to cause system instability or execute arbitrary code.

This vulnerability affects systems with NVDIMM (Non-Volatile DIMM) persistent memory hardware. The issue only manifests during an unlikely error path when device_add() fails due to allocation failure during asynchronous initialization. Systems without NVDIMM hardware are not affected, and the error condition is rare under normal memory conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.