Skip to main content

Linux Kernel EUVDEUVD-2026-26566

| CVE-2026-31753 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-01 Linux
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector with low-privilege requirement; purely an availability impact (kernel panic); no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:17 vuln.today
CVSS changed
May 08, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:02 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26566
CVE Published
May 01, 2026 - 14:14 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:14 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

auxdisplay: line-display: fix NULL dereference in linedisp_release

linedisp_release() currently retrieves the enclosing struct linedisp via to_linedisp(). That lookup depends on the attachment list, but the attachment may already have been removed before put_device() invokes the release callback. This can happen in linedisp_unregister(), and can also be reached from some linedisp_register() error paths.

In that case, to_linedisp() returns NULL and linedisp_release() dereferences it while freeing the display resources.

The struct device released here is the embedded linedisp->dev used by linedisp_register(), so retrieve the enclosing object directly with container_of() instead.

AnalysisAI

NULL pointer dereference in the Linux kernel's auxdisplay line-display driver (linedisp_release()) causes a local denial of service through a kernel panic. The flaw exists because linedisp_release() relies on to_linedisp() - which depends on the device attachment list - but that attachment may already be removed before put_device() invokes the release callback, causing a NULL dereference during resource cleanup. Triggered from linedisp_unregister() or linedisp_register() error paths, exploitation requires local low-privilege access on a system running the auxdisplay module. No public exploit exists and EPSS is 0.02% (5th percentile), confirming this as a stability fix with minimal real-world security urgency.

Technical ContextAI

The vulnerability resides in the Linux kernel's auxdisplay subsystem, specifically in the linedisp_release() function within drivers/auxdisplay/line-display.c. The root cause (CWE-476: NULL Pointer Dereference) is a lifetime management error: to_linedisp() retrieves the enclosing struct linedisp by walking the device attachment list, but in linedisp_unregister() the attachment is already detached before put_device() triggers the release callback, leaving to_linedisp() returning NULL. The same defect is reachable from error cleanup paths within linedisp_register(). The fix replaces the attachment-dependent to_linedisp() lookup with a direct container_of() call on the embedded linedisp->dev pointer, which remains valid throughout the release callback lifetime. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, spanning multiple stable branches. This is a classic kernel object lifetime bug rather than a security-first vulnerability.

RemediationAI

The primary fix is upgrading to Linux kernel 6.19.12, which includes the corrected container_of() implementation for linedisp_release(). The upstream fix commits are available at https://git.kernel.org/stable/c/625fdac41cfc4ca9e1774a0d31d7985aec2c1d66 and https://git.kernel.org/stable/c/7f138de156b20d9f9da6f72f90b63c01941d97d3 for manual application to other stable branches. Red Hat and SUSE users should monitor vendor advisories for distribution-packaged kernel updates. As a compensating control on systems where patching is not immediately possible, unloading or blacklisting the auxdisplay line-display kernel module (if not required by hardware) prevents the vulnerable code path from being reachable - this has no side effect on systems without auxdisplay hardware. No generic network-layer mitigations are applicable given the local attack vector.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-26566 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy