Linux: NULL Pointer Dereference
CVE-2026-31453 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c8a2ab339b88d10fc34a3318c92f07d8a467019d, 7121b22b0bac89394cc4c6a54b5aebc15347bdf5, c4d603e8e58a3bf35480135ccca2b4f7238abda5 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to c8a2ab339b88d10fc34a3318c92f07d8a467019d or 7121b22b0bac89394cc4c6a54b5aebc15347bdf5 or c4d603e8e58a3bf35480135ccca2b4f7238abda5 or 95fb5d643cc70959baa54cd17f52f80ffc3295e7, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.168 or 6.6.131 or 6.12.80 or 6.18.21, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 90c60e16401248a4900f3f9387f563d0178dcf34 up to, but not including, c8a2ab339b88d10fc34a3318c92f07d8a467019d; 90c60e16401248a4900f3f9387f563d0178dcf34 up to, but not including, 7121b22b0bac89394cc4c6a54b5aebc15347bdf5; 90c60e16401248a4900f3f9387f563d0178dcf34 up to, but not including, c4d603e8e58a3bf35480135ccca2b4f7238abda5; 90c60e16401248a4900f3f9387f563d0178dcf34 up to, but not including, 95fb5d643cc70959baa54cd17f52f80ffc3295e7; 90c60e16401248a4900f3f9387f563d0178dcf34 up to, but not including, 451c6329d9afa45862c36fe6677eb7750db60617; 90c60e16401248a4900f3f9387f563d0178dcf34 up to, but not including, 79ef34ec0554ec04bdbafafbc9836423734e1bd6; 5.9 | c8a2ab339b88d10fc34a3318c92f07d8a467019d, 7121b22b0bac89394cc4c6a54b5aebc15347bdf5, c4d603e8e58a3bf35480135ccca2b4f7238abda5, 95fb5d643cc70959baa54cd17f52f80ffc3295e7, 451c6329d9afa45862c36fe6677eb7750db60617, 79ef34ec0554ec04bdbafafbc9836423734e1bd6 |
| Linux | Linux Kernel | 5.9 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.131; 6.7 up to, but not including, 6.12.80; 6.13 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; 7.0 | 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background inode reclaim or the dquot shrinker can free the log item while the AIL lock is not held, and the tracepoints in the switch statement dereference the log item after iop_push() returns. Fix this by capturing the log item type, flags, and LSN before calling xfsaild_push_item(), and introducing a new xfs_ail_push_class trace event class that takes these pre-captured values and the ailp pointer instead of the log item pointer.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How developers prevent this class of flaw
- For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
- Select a programming language that is not susceptible to these issues.
- Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617
- git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5
- git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6
- git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7
- git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5
- git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d
Recent NULL Pointer Dereference vulnerabilities
- 7.5 High severity
- 8.8 High severity
- 9.8 Critical severity
- 8.2 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.