Skip to main content

Linux Kernel EUVDEUVD-2026-25539

| CVE-2026-31646 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-04-24 Linux GHSA-vv8c-r99f-f6q8
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only attack path, low-privilege trigger, no confidentiality or integrity impact - purely a kernel crash on lan966x hardware.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:49 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:19 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25539
CVE Published
Apr 24, 2026 - 14:44 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()

page_pool_create() can return an ERR_PTR on failure. The return value is used unconditionally in the loop that follows, passing the error pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(), which dereferences it, causing a kernel oops.

Add an IS_ERR check after page_pool_create() to return early on failure.

AnalysisAI

Null pointer dereference in the Linux kernel's lan966x FDMA network driver crashes the kernel when page_pool_create() fails during receive pool initialization. Affected systems running lan966x network controller hardware can be brought down by a local low-privileged user who triggers a page pool allocation failure, resulting in a kernel oops via dereference of an ERR_PTR in xdp_rxq_info_reg_mem_model(). No public exploit or active exploitation (CISA KEV) has been identified; EPSS at 0.02% (5th percentile) confirms negligible observed exploitation activity.

Technical ContextAI

The vulnerability resides in lan966x_fdma_rx_alloc_page_pool() within the Linux kernel's lan966x FDMA (Flexible DMA) network subsystem, which manages the receive path for the Microchip lan966x embedded Ethernet switch controller. The function calls page_pool_create() to allocate an XDP-compatible memory pool for network buffer pages. Per Linux kernel convention, page_pool_create() signals failure via ERR_PTR rather than NULL, returning a negative error code cast to a pointer. The code omits an IS_ERR() guard after the call, unconditionally passing the error pointer into xdp_rxq_info_reg_mem_model(), which internally calls page_pool_use_xdp_mem() and dereferences the invalid pointer, triggering a kernel oops. CWE-476 (NULL Pointer Dereference) covers this class of unchecked error-pointer dereference. The fix, introduced upstream commit by commit across stable branches, adds the missing IS_ERR() check to return early on allocation failure. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0, depending on the stable branch in use. Upstream fix commits are available at git.kernel.org (e63265f188ea, 305832c53551, b5dcb41ba891, 7caf90d9ab97, 3fd0da4fd885). Ubuntu users should apply the patch per USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1); Red Hat and SUSE users should monitor their respective errata streams. If immediate patching is not feasible and the lan966x driver is not operationally required, blacklisting the module eliminates exposure entirely: add 'blacklist lan966x' to /etc/modprobe.d/blacklist.conf and rebuild the initramfs - the trade-off is that lan966x network interfaces will cease to function. Ensuring adequate system memory to reduce the probability of page_pool_create() failure is not a reliable mitigation and should not be used as a substitute for patching.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25539 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy