Skip to main content

Linux Kernel CVE-2026-31651

| EUVDEUVD-2026-25544 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-gv6p-37ww-qhq7
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger via hardware disconnect requires PR:L; no confidentiality or integrity impact; kernel panic = full availability loss on the affected host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:47 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:14 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25544
CVE Published
Apr 24, 2026 - 14:45 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

mmc: vub300: fix NULL-deref on disconnect

Make sure to deregister the controller before dropping the reference to the driver data on disconnect to avoid NULL-pointer dereferences or use-after-free.

AnalysisAI

NULL pointer dereference in the Linux kernel vub300 USB MMC driver allows a local authenticated attacker to crash the kernel by disconnecting a VUB300-based USB MMC adapter while the driver is active. The disconnect handler releases the driver data reference before deregistering the MMC controller, creating a window for NULL dereference or use-after-free that results in a kernel panic and denial of service. No active exploitation has been confirmed - EPSS is 0.02% (7th percentile) and the vulnerability is absent from the CISA KEV catalog.

Technical ContextAI

The vub300 is a USB-to-MMC/SD bridge controller chip; its Linux kernel driver (drivers/mmc/host/vub300.c) manages both USB lifecycle events and MMC host controller registration. CWE-476 (NULL Pointer Dereference) applies because the disconnect callback tears down the private driver data structure - dropping the kref - before calling mmc_remove_host(), which continues to reference that data. This ordering violation leaves dangling pointers accessible to in-flight MMC operations, yielding either a NULL deref or use-after-free in kernel context. The affected CPE cpe:2.3:a:linux:linux spans multiple stable branches starting from the introducing commit 88095e7b473a3d9ec3b9c60429576e9cbd327c89 (kernel 3.0 era), indicating the race has been present across more than a decade of stable releases.

RemediationAI

The primary fix is to upgrade to a patched stable kernel: 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0. Upstream fix commits are available at git.kernel.org/stable (see references: 6446516e, ba3b9429, 517b58e1, 6468cab1, 53f2642d, c83a2826, 8d09e757, dff34ef8). Ubuntu users should apply the patch referenced in USN-8567-1. As a compensating control where patching is not immediately possible, administrators can blacklist the vub300 kernel module via echo 'blacklist vub300' >> /etc/modprobe.d/blacklist.conf followed by update-initramfs -u - the trade-off is loss of VUB300 USB MMC adapter functionality. Siemens-embedded deployments should consult SSA-019113 and SSA-082556 for vendor-specific guidance.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31651 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy