CVE-2026-31744
Awaiting Analysis Awaiting Analysis - Queue
NULL Pointer Dereference in Linux Kernel Energy Model

Publication date: 2026-05-01

Last updated on: 2026-05-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: PM: EM: Fix NULL pointer dereference when perf domain ID is not found dev_energymodel_nl_get_perf_domains_doit() calls em_perf_domain_get_by_id() but does not check the return value before passing it to __em_nl_get_pd_size(). When a caller supplies a non-existent perf domain ID, em_perf_domain_get_by_id() returns NULL, and __em_nl_get_pd_size() immediately dereferences pd->cpus (struct offset 0x30), causing a NULL pointer dereference. The sister handler dev_energymodel_nl_get_perf_table_doit() already handles this correctly via __em_nl_get_pd_table_id(), which returns NULL and causes the caller to return -EINVAL. Add the same NULL check in the get-perf-domains do handler. [ rjw: Subject and changelog edits ]
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-01
Generated
2026-05-07
AI Q&A
2026-05-02
EPSS Evaluated
2026-05-05
NVD
CVE-2026-31744
EUVD
EUVD-2026-26557
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.


Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's power management energy model (PM EM) subsystem. Specifically, a function called dev_energymodel_nl_get_perf_domains_doit() calls another function em_perf_domain_get_by_id() without checking if the returned value is NULL. If a caller provides a non-existent performance domain ID, em_perf_domain_get_by_id() returns NULL, and the subsequent function __em_nl_get_pd_size() dereferences this NULL pointer, leading to a NULL pointer dereference error.

This issue occurs because the code does not validate the existence of the performance domain ID before using it, which can cause the kernel to crash or behave unexpectedly.


How can this vulnerability impact me? :

The impact of this vulnerability is that it can cause a NULL pointer dereference in the Linux kernel, which typically results in a kernel crash or system instability. This can lead to denial of service (DoS) conditions where the affected system becomes unresponsive or requires a reboot.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart