Skip to main content

Linux Kernel CVE-2026-31549

| EUVDEUVD-2026-25442 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-cx2j-r37j-67j2
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Physical USB access is a local vector; low privilege needed to trigger probe; only availability impacted via kernel panic, no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:P/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:15 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:15 nvd
Patch available
Patch available
Apr 24, 2026 - 16:01 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25442
CVE Published
Apr 24, 2026 - 14:33 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i2c: cp2615: fix serial string NULL-deref at probe

The cp2615 driver uses the USB device serial string as the i2c adapter name but does not make sure that the string exists.

Verify that the device has a serial number before accessing it to avoid triggering a NULL-pointer dereference (e.g. with malicious devices).

AnalysisAI

NULL pointer dereference in the Linux kernel's cp2615 i2c driver crashes the kernel when a USB device lacking a serial number string is probed, resulting in denial of service. The cp2615 driver unconditionally uses the USB serial string as the i2c adapter name without first verifying the pointer is non-NULL, a flaw exploitable by connecting a crafted or malformed CP2615 USB-to-I2C bridge device. No active exploitation is confirmed (not in CISA KEV) and the EPSS score of 0.02% at the 7th percentile reflects negligible exploitation interest; impact is limited to availability with no code execution or data exposure possible.

Technical ContextAI

The affected component is the cp2615 i2c driver in the Linux kernel, which implements support for Silicon Laboratories CP2615 USB-to-I2C bridge devices. During the device probe sequence, the driver retrieves the USB device's serial number string and uses it directly as the i2c adapter name without validating that the string pointer is non-NULL. This is a textbook CWE-476 (NULL Pointer Dereference) defect: if the USB device presents no serial number descriptor - either by design or by malicious crafting - the pointer is NULL and the subsequent dereference triggers a kernel oops or panic. The vulnerability was introduced at commit 4a7695429eade517b07ea72f9ec366130e81a076 (Linux 5.13) and persists across all stable branches until the respective fix commits. Affected CPE: cpe:2.3:a:linux:linux:*.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version for the relevant stable branch: 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or 7.0. Upstream fix commits are available at git.kernel.org, including https://git.kernel.org/stable/c/e68c267787778bcdf3d91b06f794faaba7f0d1d1 and related commits for each stable branch. Ubuntu users should apply the update from USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1); Red Hat and SUSE users should consult their respective vendor advisories. As a compensating control where immediate patching is not possible, prevent the cp2615 module from loading by adding it to the kernel module blacklist (e.g., echo 'blacklist cp2615' >> /etc/modprobe.d/blacklist.conf), which eliminates the attack surface entirely but disables all CP2615 USB-to-I2C bridge functionality. Additionally, enforcing strict USB device authorization via the kernel's USB authorization framework (echo 0 > /sys/bus/usb/devices/usbX/authorized_default) can prevent unauthorized USB devices from being probed at all, with the trade-off of requiring explicit per-device authorization.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31549 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy