Skip to main content

Linux Kernel CVE-2026-31546

| EUVDEUVD-2026-25439 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-wqj5-2hrg-w494
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack vector with low-privilege read of debugfs required; pure availability impact via kernel panic; no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:16 vuln.today
CVSS changed
Apr 28, 2026 - 20:53 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 20:48 nvd
Patch available
Patch available
Apr 24, 2026 - 16:01 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25439
CVE Published
Apr 24, 2026 - 14:33 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: fix NULL deref in bond_debug_rlb_hash_show

rlb_clear_slave intentionally keeps RLB hash-table entries on the rx_hashtbl_used_head list with slave set to NULL when no replacement slave is available. However, bond_debug_rlb_hash_show visites client_info->slave without checking if it's NULL.

Other used-list iterators in bond_alb.c already handle this NULL-slave state safely:

  • rlb_update_client returns early on !client_info->slave
  • rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance

compare slave values before visiting

  • lb_req_update_subnet_clients continues if slave is NULL

The following NULL deref crash can be trigger in bond_debug_rlb_hash_show:

[ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41) [ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286 [ 1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204 [ 1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078 [ 1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000 [ 1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0 [ 1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8 [ 1.294864] FS: 0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000 [ 1.295239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0 [ 1.295897] Call Trace: [ 1.296134] seq_read_iter (fs/seq_file.c:231) [ 1.296341] seq_read (fs/seq_file.c:164) [ 1.296493] full_proxy_read (fs/debugfs/file.c:378 (discriminator 1)) [ 1.296658] vfs_read (fs/read_write.c:572) [ 1.296981] ksys_read (fs/read_write.c:717) [ 1.297132] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 1.297325] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

Add a NULL check and print "(none)" for entries with no assigned slave.

AnalysisAI

NULL pointer dereference in the Linux kernel bonding driver's RLB debug interface allows a local low-privileged user to crash the kernel, causing a denial of service. Specifically, bond_debug_rlb_hash_show in bond_debugfs.c dereferences client_info->slave without a NULL guard - a condition intentionally created by rlb_clear_slave when no replacement bonding slave is available - producing a BUG: kernel NULL pointer dereference at address 0x0. Affected across multiple stable kernel trees from 5.10.x through 7.0; no public exploit code exists and EPSS is 0.02%, consistent with low opportunistic risk, though Siemens PSIRT has issued downstream advisories (SSA-019113, SSA-082556) indicating industrial/embedded impact.

Technical ContextAI

The Linux kernel bonding driver implements Adaptive Load Balancing (ALB), which includes Receive Load Balancing (RLB) managed via an internal hash table (rx_hashtbl) that maps network clients to bonding slave interfaces. The function rlb_clear_slave intentionally leaves entries on the rx_hashtbl_used_head list with client_info->slave set to NULL when a slave is removed and no replacement is available - this is a documented, deliberate invariant. All other iterators in bond_alb.c - including rlb_update_client, rlb_req_update_slave_clients, rlb_rebalance, and lb_req_update_subnet_clients - defensively guard against this NULL state before dereferencing. The vulnerable function bond_debug_rlb_hash_show in drivers/net/bonding/bond_debugfs.c:41 is the sole outlier, missing this guard. CWE-476 (NULL Pointer Dereference) is the precise root cause classification. The fix adds a NULL check printing '(none)' for entries without an assigned slave. Introduced at commit caafa84251b886feb6cdf23d50e2cc99dcdaaaf3; CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Update the Linux kernel to a patched stable release: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or 7.0. The upstream fix commits are available at https://git.kernel.org/stable/c/19f0fd87df0e5746b24f5caa465a66a8c6e6e241 and the corresponding stable-tree patches linked in the CVE references. Ubuntu users should apply the security update from USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1). Siemens product operators should consult SSA-019113 and SSA-082556 for product-specific guidance. Where immediate patching is not feasible, restrict or remove debugfs access: unmounting debugfs (umount /sys/kernel/debug) or making it inaccessible to non-root users eliminates the trigger path entirely, though this removes all kernel debug visibility and may impact monitoring tooling. An alternative compensating control is to reconfigure the bonding interface out of ALB/mode 6, which removes RLB entirely and eliminates the vulnerable code path - at the trade-off of losing adaptive receive load balancing.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31546 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy