CVE-2026-31544

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31544", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.114Z", "datePublished": "2026-04-24T14:33:13.173Z", "dateUpdated": "2026-05-11T22:10:49.780Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:10:49.780Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix NULL dereference on notify error path\n\nSince commit b5daf93b809d1 (\"firmware: arm_scmi: Avoid notifier\nregistration for unsupported events\") the call chains leading to the helper\n__scmi_event_handler_get_ops expect an ERR_PTR to be returned on failure to\nget an handler for the requested event key, while the current helper can\nstill return a NULL when no handler could be found or created.\n\nFix by forcing an ERR_PTR return value when the handler reference is NULL."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scmi/notify.c"], "versions": [{"version": "b5daf93b809d13a194f8a8eeacfab1cfa241bbc3", "lessThan": "70d9bd9a2e683afe6200b0c20af22f06f1a199a4", "status": "affected", "versionType": "git"}, {"version": "b5daf93b809d13a194f8a8eeacfab1cfa241bbc3", "lessThan": "8414d2800c34528467df23ce6192c254a73e4459", "status": "affected", "versionType": "git"}, {"version": "b5daf93b809d13a194f8a8eeacfab1cfa241bbc3", "lessThan": "555317d6100164748f7d09f80142739bd29f0cda", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firmware/arm_scmi/notify.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/70d9bd9a2e683afe6200b0c20af22f06f1a199a4"}, {"url": "https://git.kernel.org/stable/c/8414d2800c34528467df23ce6192c254a73e4459"}, {"url": "https://git.kernel.org/stable/c/555317d6100164748f7d09f80142739bd29f0cda"}], "title": "firmware: arm_scmi: Fix NULL dereference on notify error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scmi/notify.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "70d9bd9a2e683afe6200b0c20af22f06f1a199a4", "status": "affected", "version": "b5daf93b809d13a194f8a8eeacfab1cfa241bbc3", "versionType": "git"}, {"lessThan": "8414d2800c34528467df23ce6192c254a73e4459", "status": "affected", "version": "b5daf93b809d13a194f8a8eeacfab1cfa241bbc3", "versionType": "git"}, {"lessThan": "555317d6100164748f7d09f80142739bd29f0cda", "status": "affected", "version": "b5daf93b809d13a194f8a8eeacfab1cfa241bbc3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firmware/arm_scmi/notify.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ED92ABC-9C7F-46BE-B94C-365F0BD854A8", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix NULL dereference on notify error path\n\nSince commit b5daf93b809d1 (\"firmware: arm_scmi: Avoid notifier\nregistration for unsupported events\") the call chains leading to the helper\n__scmi_event_handler_get_ops expect an ERR_PTR to be returned on failure to\nget an handler for the requested event key, while the current helper can\nstill return a NULL when no handler could be found or created.\n\nFix by forcing an ERR_PTR return value when the handler reference is NULL."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfirmware: arm_scmi: Correcci\u00f3n de desreferencia NULL en la ruta de error de notificaci\u00f3n\n\nDesde el commit b5daf93b809d1 (\u2019firmware: arm_scmi: Evitar el registro de notificador para eventos no soportados\u2019), las cadenas de llamadas que conducen al ayudante __scmi_event_handler_get_ops esperan que se devuelva un ERR_PTR al fallar en obtener un gestor para la clave de evento solicitada, mientras que el ayudante actual a\u00fan puede devolver un NULL cuando no se pudo encontrar o crear ning\u00fan gestor.\n\nSoluci\u00f3n forzando un valor de retorno ERR_PTR cuando la referencia del gestor es NULL."}], "id": "CVE-2026-31544", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:28.457", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/555317d6100164748f7d09f80142739bd29f0cda"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70d9bd9a2e683afe6200b0c20af22f06f1a199a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8414d2800c34528467df23ce6192c254a73e4459"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: firmware: arm_scmi: Fix NULL dereference on notify error path", "id": "2461497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461497"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's arm_scmi firmware component. The __scmi_event_handler_get_ops helper function can return a NULL pointer when an event handler is not found or created, instead of an expected error pointer. This improper handling of the error path leads to a NULL dereference vulnerability. Exploitation of this flaw can cause a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-31544", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31544\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31544\nhttps://lore.kernel.org/linux-cve-announce/2026042424-CVE-2026-31544-7fc3@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b5daf93b809d13a194f8a8eeacfab1cfa241bbc3,70d9bd9a2e683afe6200b0c20af22f06f1a199a4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b5daf93b809d13a194f8a8eeacfab1cfa241bbc3,8414d2800c34528467df23ce6192c254a73e4459)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b5daf93b809d13a194f8a8eeacfab1cfa241bbc3,555317d6100164748f7d09f80142739bd29f0cda)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T06:48:27.265739+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that incorporates commit b5daf93b809d1.", "If an update is unavailable, backport the patch to your current kernel source and rebuild the kernel.", "After rebuilding, verify that Scmi event notifications no longer trigger NULL dereference errors, and if problems persist, consider disabling Scmi support in the kernel configuration."], "summary": {"action": "Immediate Patch", "impact": "Kernel crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "All releases of the Linux kernel that contain the arm_scmi firmware subsystem and do not include the commit b5daf93b809d1 (the fix). No explicit vulnerable version range is listed, so any kernel prior to that commit is potentially affected. The vulnerability applies to the Linux:Linux product family.", "description_and_impact": "The Linux firmware subsystem for Arm Scmi had a flaw that allowed a NULL pointer dereference when handling notifications for unsupported events. The helper function responsible for retrieving an event handler could return NULL instead of an error pointer, causing code later to dereference this NULL value and crash the kernel. This is a classic null dereference vulnerability (CWE\u2011476) that results in a kernel OOPS and loss of availability.", "risk_and_exploitability": "The CVSS score of 5.5 indicates a medium\u2011severity condition. The EPSS score of <\u202f1\u202f% shows that the probability of exploitation is very low at present. The vulnerability is not listed in the CISA KEV catalog, which further suggests limited current exploitation activity. The likely attack vector is local, requiring code that can trigger the scm event path; the issue primarily leads to a crash rather than privilege escalation. Overall risk is moderate, with the main threat being denial of service through a kernel crash."}}}}, "created": "2026-04-27T19:15:11.625091+00:00", "updated": "2026-04-28T07:00:09.486831+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}