CVE-2026-31481

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31481", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.100Z", "datePublished": "2026-04-22T13:54:08.236Z", "dateUpdated": "2026-05-11T22:09:34.083Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:09:34.083Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_trigger.c"], "versions": [{"version": "61d445af0a7c70018111919e47beaaee15653f2f", "lessThan": "771624b7884a83bb9f922ae64ee41a5f8b7576c9", "status": "affected", "versionType": "git"}, {"version": "61d445af0a7c70018111919e47beaaee15653f2f", "lessThan": "250ab25391edeeab8462b68be42e4904506c409c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_trigger.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9"}, {"url": "https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"}], "title": "tracing: Drain deferred trigger frees if kthread creation fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_trigger.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "771624b7884a83bb9f922ae64ee41a5f8b7576c9", "status": "affected", "version": "61d445af0a7c70018111919e47beaaee15653f2f", "versionType": "git"}, {"lessThan": "250ab25391edeeab8462b68be42e4904506c409c", "status": "affected", "version": "61d445af0a7c70018111919e47beaaee15653f2f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_trigger.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5054C854-C253-4020-BD2E-2BDA121E424C", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrastreo: Drenar liberaciones de disparadores diferidas si la creaci\u00f3n de kthread falla\n\nEl registro de disparadores en tiempo de arranque puede fallar antes de que exista el kthread de limpieza de datos del disparador. Diferir esas liberaciones hasta la inicializaci\u00f3n tard\u00eda est\u00e1 bien, pero la alternativa posterior al arranque a\u00fan debe drenar la lista diferida si la creaci\u00f3n de kthread nunca tiene \u00e9xito.\n\nDe lo contrario, los nodos diferidos en el arranque pueden acumularse en trigger_data_free_list, las liberaciones posteriores recurren a liberar sincr\u00f3nicamente solo el objeto actual, y las entradas en cola m\u00e1s antiguas se filtran para siempre.\n\nPara activar esto, a\u00f1ada lo siguiente a la l\u00ednea de comandos del kernel:\n\ntrace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nEl segundo disparador traceon fallar\u00e1 y ser\u00e1 liberado. Esto activa una desreferencia de puntero NULL y bloquea el kernel.\n\nMantenga el comportamiento diferido en tiempo de arranque, pero cuando la creaci\u00f3n de kthread falla, drene toda la lista en cola sincr\u00f3nicamente. Haga lo mismo en la ruta de drenaje de inicializaci\u00f3n tard\u00eda para que las entradas en cola tampoco queden varadas all\u00ed."}], "id": "CVE-2026-31481", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-22T14:16:45.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: tracing: Drain deferred trigger frees if kthread creation fails", "id": "2460687", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460687"}, "csaw": false, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel. A local user can exploit this vulnerability by providing specific kernel command line parameters during boot, which can lead to a NULL pointer dereference. This issue occurs due to improper handling of deferred trigger frees when kernel thread (kthread) creation fails. Successful exploitation can cause the system to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-31481", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31481\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31481\nhttps://lore.kernel.org/linux-cve-announce/2026042258-CVE-2026-31481-390e@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61d445af0a7c70018111919e47beaaee15653f2f,771624b7884a83bb9f922ae64ee41a5f8b7576c9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61d445af0a7c70018111919e47beaaee15653f2f,250ab25391edeeab8462b68be42e4904506c409c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:58:39.321162+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that contains the tracing fix.", "If an immediate kernel upgrade is not possible, remove or avoid using the second traceon trigger that is known to fail, ensuring only successful triggers are enabled on the command line.", "Reboot the system after making the changes to enforce the updated kernel or modified boot settings."], "summary": {"action": "Apply patch", "impact": "Kernel crash via NULL pointer dereference"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all Linux kernel builds that contain the old tracing implementation prior to the applied patch. All current kernel releases that have not incorporated the fix remain susceptible; the exact affected kernel versions are not enumerated in the data.", "description_and_impact": "In the Linux kernel, a bug in the tracing subsystem allows faulty boot\u2011time trigger registration to leak memory and trigger a NULL pointer dereference, causing an immediate kernel crash. The flaw manifests when a second traceon trigger fails to start its cleanup kthread before the deferred trigger list is drained, leaving orphaned entries that are freed later as a null pointer. The resulting crash disrupts system availability and can be triggered through a modified kernel boot command line.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% indicates a low probability of exploitation. The flaw is not included in the CISA KEV catalog, indicating limited public exploitation data. The exploit requires precise control of the kernel boot command line, so it is effectively a local attack that only succeeds if the attacker can modify boot parameters or influence a compromised machine\u2019s bootloader. The lack of a public exploit suggests a low exploitation probability, but the impact of a kernel crash is severe and warrants remediation."}}}}, "created": "2026-04-22T19:00:08.094374+00:00", "updated": "2026-04-28T21:00:14.768128+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}