Skip to main content

Linux Kernel CVE-2026-31577

| EUVDEUVD-2026-25470 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-9pgh-55q5-rvp6
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only attack via ioctl on mounted nilfs2 volume requires low privilege; only availability (kernel crash) is impacted, with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:05 vuln.today
CVSS changed
Apr 27, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:41 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25470
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC.

If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault.

Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it.

AnalysisAI

NULL pointer dereference in the Linux kernel's nilfs2 filesystem driver allows a local, low-privileged attacker to crash the kernel by invoking the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting a nilfs2 filesystem, before the DAT inode's btree node cache is lazily initialized. The impact is a general protection fault and full denial of service; no confidentiality or integrity impact is possible. No public exploit is known at time of analysis, and EPSS at 0.02% (5th percentile) reflects extremely low real-world exploitation probability.

Technical ContextAI

The nilfs2 (New Implementation of a Log-structured File System 2) driver in the Linux kernel uses a Disk Address Translation (DAT) inode whose btree node cache is stored in the i_assoc_inode field. This pointer is initialized lazily - only during actual btree operations - rather than eagerly at mount time. The garbage collection routine nilfs_mdt_save_to_shadow_map(), triggered by the NILFS_IOCTL_CLEAN_SEGMENTS ioctl, copies dirty pages from the DAT inode to a shadow map and unconditionally dereferences i_assoc_inode. If GC is invoked before any btree operation has occurred post-mount, i_assoc_inode is NULL, producing a general protection fault. Root cause class is CWE-476 (NULL Pointer Dereference). The fix, applied in nilfs_dat_read() at mount time, calls nilfs_attach_btree_node_cache() eagerly so i_assoc_inode is always valid before any GC path can execute. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected range.

RemediationAI

Upgrade to a patched kernel version: 6.12.83, 6.18.24, 6.19.14, or 7.0.1 for the corresponding stable branch. Fix commits are available at the Linux stable tree, including 449ec5fc99f45974525ba9eea16b6670c45cd363 (6.19.x), 97fb7afec404912d967a7d4715f37742666b3084, 41de342278ae025c99cc8d33648773f05e306cf1 (6.12.x), and c36e206f302f1ddefed92d09ecbba070e1ae079e. Ubuntu users should apply the packages referenced in USN-8488-1 at https://ubuntu.com/security/notices/USN-8488-1. As a compensating control where immediate patching is not possible, avoid mounting nilfs2 filesystems or restrict access to the NILFS_IOCTL_CLEAN_SEGMENTS ioctl by limiting filesystem administration to root-only accounts and preventing unprivileged users from performing GC operations. Note that this workaround does not protect against a malicious local administrator.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31577 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy