CVE-2026-31541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31541", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.114Z", "datePublished": "2026-04-24T14:33:10.505Z", "dateUpdated": "2026-05-11T22:10:46.355Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:10:46.355Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix trace_marker copy link list updates\n\nWhen the \"copy_trace_marker\" option is enabled for an instance, anything\nwritten into /sys/kernel/tracing/trace_marker is also copied into that\ninstances buffer. When the option is set, that instance's trace_array\ndescriptor is added to the marker_copies link list. This list is protected\nby RCU, as all iterations uses an RCU protected list traversal.\n\nWhen the instance is deleted, all the flags that were enabled are cleared.\nThis also clears the copy_trace_marker flag and removes the trace_array\ndescriptor from the list.\n\nThe issue is after the flags are called, a direct call to\nupdate_marker_trace() is performed to clear the flag. This function\nreturns true if the state of the flag changed and false otherwise. If it\nreturns true here, synchronize_rcu() is called to make sure all readers\nsee that its removed from the list.\n\nBut since the flag was already cleared, the state does not change and the\nsynchronization is never called, leaving a possible UAF bug.\n\nMove the clearing of all flags below the updating of the copy_trace_marker\noption which then makes sure the synchronization is performed.\n\nAlso use the flag for checking the state in update_marker_trace() instead\nof looking at if the list is empty."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace.c"], "versions": [{"version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "lessThan": "75668e58244e63ec3785098a02e1cdcff14a6c2e", "status": "affected", "versionType": "git"}, {"version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "lessThan": "cc267e4b4302247dc67ef937a9ac587a696a43c1", "status": "affected", "versionType": "git"}, {"version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "lessThan": "07183aac4a6828e474f00b37c9d795d0d99e18a7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/75668e58244e63ec3785098a02e1cdcff14a6c2e"}, {"url": "https://git.kernel.org/stable/c/cc267e4b4302247dc67ef937a9ac587a696a43c1"}, {"url": "https://git.kernel.org/stable/c/07183aac4a6828e474f00b37c9d795d0d99e18a7"}], "title": "tracing: Fix trace_marker copy link list updates", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/trace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "75668e58244e63ec3785098a02e1cdcff14a6c2e", "status": "affected", "version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "versionType": "git"}, {"lessThan": "cc267e4b4302247dc67ef937a9ac587a696a43c1", "status": "affected", "version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "versionType": "git"}, {"lessThan": "07183aac4a6828e474f00b37c9d795d0d99e18a7", "status": "affected", "version": "7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/trace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C570CE1-BC61-4BE6-9393-FD0CA8637367", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix trace_marker copy link list updates\n\nWhen the \"copy_trace_marker\" option is enabled for an instance, anything\nwritten into /sys/kernel/tracing/trace_marker is also copied into that\ninstances buffer. When the option is set, that instance's trace_array\ndescriptor is added to the marker_copies link list. This list is protected\nby RCU, as all iterations uses an RCU protected list traversal.\n\nWhen the instance is deleted, all the flags that were enabled are cleared.\nThis also clears the copy_trace_marker flag and removes the trace_array\ndescriptor from the list.\n\nThe issue is after the flags are called, a direct call to\nupdate_marker_trace() is performed to clear the flag. This function\nreturns true if the state of the flag changed and false otherwise. If it\nreturns true here, synchronize_rcu() is called to make sure all readers\nsee that its removed from the list.\n\nBut since the flag was already cleared, the state does not change and the\nsynchronization is never called, leaving a possible UAF bug.\n\nMove the clearing of all flags below the updating of the copy_trace_marker\noption which then makes sure the synchronization is performed.\n\nAlso use the flag for checking the state in update_marker_trace() instead\nof looking at if the list is empty."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntracing: Soluci\u00f3n a las actualizaciones de la lista enlazada de copia de trace_marker\n\nCuando la opci\u00f3n \u2019copy_trace_marker\u2019 est\u00e1 habilitada para una instancia, cualquier cosa escrita en /sys/kernel/tracing/trace_marker tambi\u00e9n se copia en el b\u00fafer de esa instancia. Cuando la opci\u00f3n est\u00e1 configurada, el descriptor trace_array de esa instancia se a\u00f1ade a la lista enlazada marker_copies. Esta lista est\u00e1 protegida por RCU, ya que todas las iteraciones utilizan un recorrido de lista protegido por RCU.\n\nCuando la instancia es eliminada, todas las banderas que estaban habilitadas se borran. Esto tambi\u00e9n borra la bandera copy_trace_marker y elimina el descriptor trace_array de la lista.\n\nEl problema es que despu\u00e9s de que se llaman las banderas, se realiza una llamada directa a update_marker_trace() para borrar la bandera. Esta funci\u00f3n devuelve verdadero si el estado de la bandera cambi\u00f3 y falso en caso contrario. Si devuelve verdadero aqu\u00ed, se llama a synchronize_rcu() para asegurarse de que todos los lectores vean que se ha eliminado de la lista.\n\nPero como la bandera ya estaba borrada, el estado no cambia y la sincronizaci\u00f3n nunca se llama, dejando un posible error UAF.\n\nMover el borrado de todas las banderas debajo de la actualizaci\u00f3n de la opci\u00f3n copy_trace_marker, lo que luego asegura que se realice la sincronizaci\u00f3n.\n\nTambi\u00e9n usar la bandera para verificar el estado en update_marker_trace() en lugar de mirar si la lista est\u00e1 vac\u00eda."}], "id": "CVE-2026-31541", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:28.117", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/07183aac4a6828e474f00b37c9d795d0d99e18a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/75668e58244e63ec3785098a02e1cdcff14a6c2e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc267e4b4302247dc67ef937a9ac587a696a43c1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: tracing: Fix trace_marker copy link list updates", "id": "2461453", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461453"}, "csaw": false, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel. When a tracing instance with the `copy_trace_marker` option is enabled and subsequently deleted, a critical synchronization step is bypassed. This can lead to a Use-After-Free (UAF) vulnerability, which may allow a local attacker to corrupt memory, potentially leading to system instability or arbitrary code execution."], "name": "CVE-2026-31541", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31541\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31541\nhttps://lore.kernel.org/linux-cve-announce/2026042423-CVE-2026-31541-af1d@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86,75668e58244e63ec3785098a02e1cdcff14a6c2e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86,cc267e4b4302247dc67ef937a9ac587a696a43c1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86,07183aac4a6828e474f00b37c9d795d0d99e18a7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T23:46:14.438743+00:00", "value": {"mitigation_remediation": ["Update to a kernel version that includes the commit which removes the RCU synchronization bug", "If an upgrade is not immediately possible, disable the copy_trace_marker feature by ensuring the \"copy_trace_marker\" option is turned off in kernel configuration or by writing a null value to the relevant sysfs entry before use", "Refrain from writing to /sys/kernel/tracing/trace_marker on unpatched systems until the kernel is upgraded"], "summary": {"action": "Immediate Patch", "impact": "Use\u2011After\u2011Free leading to memory corruption in the Linux kernel"}, "threat_synthesis": {"affected_systems": "The issue appears in any Linux kernel that includes the trace_marker copy feature before the fix; it is vendor\u2011agnostic and applies to all releases that contain the unpatched implementation. No specific affected versions are listed in the data, so any kernel compiled with the copy_trace_marker option enabled is at risk.", "description_and_impact": "The vulnerability is a classic use\u2011after\u2011free in the Linux kernel\u2019s trace_marker copy mechanism. When the copy_trace_marker option is enabled, data written to /sys/kernel/tracing/trace_marker is copied to an instance\u2019s buffer and the instance\u2019s descriptor is added to a list protected by RCU. During instance deletion, the flag that enables copying is cleared before the list is atomically removed, so the required RCU synchronization is omitted. This allows a reader to access freed memory, potentially corrupting the kernel or providing a foothold for arbitrary code execution. The flaw is consistent with CWE\u2011416 and CWE\u2011825, representing a critical kernel memory corruption risk.", "risk_and_exploitability": "The EPSS score is below 1% and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating low observed exploitation probability to date. However, kernel use\u2011after\u2011free bugs typically carry a high impact rating and can be leveraged by an attacker with local privileges to crash the system or execute code with kernel privileges. The CVSS score is 7.8, reflecting a high severity evaluation. Attackers would need to enable or trigger the trace_marker write path while the copy option is active, which generally requires root or CAP_SYS_ADMIN privileges."}}}}, "created": "2026-04-27T19:15:11.626513+00:00", "updated": "2026-04-29T00:00:13.789543+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}