CVE-2026-31481
Use-After-Free in Linux Kernel Tracing Causes Kernel Crash
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.19.1 (inc) to 6.19.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's tracing subsystem. It occurs when boot-time trigger registration fails before the trigger-data cleanup kernel thread (kthread) is created. Normally, deferred frees are handled later during initialization, but if the kthread creation fails, the deferred free list is not properly drained. This causes boot-deferred nodes to accumulate indefinitely, leading to memory leaks.
Specifically, if a second trace trigger fails to register (for example, by adding certain parameters to the kernel command line), it causes a NULL pointer dereference that crashes the kernel. The fix involves ensuring that when kthread creation fails, the entire deferred free list is synchronously drained to prevent leaks and crashes.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference triggered by failed trace trigger registration during boot. Additionally, it can lead to memory leaks as deferred free nodes accumulate indefinitely if the cleanup thread is not created.
The impact includes system instability and potential denial of service due to kernel crashes, which can affect system availability and reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be triggered by adding specific parameters to the kernel command line that cause a NULL pointer dereference and kernel crash.
- Check if the kernel command line includes: trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon
- Monitor for kernel crashes or NULL pointer dereferences related to tracing triggers.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that the kernel is updated to a version where this vulnerability is fixed.
Avoid using the kernel command line parameters that trigger the vulnerability, specifically the double traceon triggers for sched_switch.