CyberSecBulletin
CVE-2026-31477NVD status: Analyzed

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-31477 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions cdac6f7e7e428dc70e3b5898ac6999a72ed13993, c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9, 91aeaa7256006d79a37298f5a1df23325db91599 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.48% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to cdac6f7e7e428dc70e3b5898ac6999a72ed13993 or c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9 or 91aeaa7256006d79a37298f5a1df23325db91599 or 3cdacd11b41569ce75b3162142240f2355e04900, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.1.168 or 6.6.131 or 6.12.80 or 6.18.21, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, cdac6f7e7e428dc70e3b5898ac6999a72ed13993; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, 91aeaa7256006d79a37298f5a1df23325db91599; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, 3cdacd11b41569ce75b3162142240f2355e04900; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, aab42f0795620cf0d3955a520f571f697d0f9a2a; e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 up to, but not including, 309b44ed684496ed3f9c5715d10b899338623512; 5.15cdac6f7e7e428dc70e3b5898ac6999a72ed13993, c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9, 91aeaa7256006d79a37298f5a1df23325db91599, 3cdacd11b41569ce75b3162142240f2355e04900, aab42f0795620cf0d3955a520f571f697d0f9a2a, 309b44ed684496ed3f9c5715d10b899338623512
LinuxLinux Kernel5.15.1 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.131; 6.7 up to, but not including, 6.12.80; 6.13 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; 5.15; 7.06.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leaks and NULL deref in smb2_lock() smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl: 1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK path, goto out leaks smb_lock and its flock because the out: handler only iterates lock_list and rollback_list, neither of which contains the detached smb_lock. 2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out leaks smb_lock and flock for the same reason. The error code returned to the dispatcher is also stale. 3) In the rollback path, smb_flock_init() can return NULL on allocation failure. The result is dereferenced unconditionally, causing a kernel NULL pointer dereference. Add a NULL check to prevent the crash and clean up the bookkeeping; the VFS lock itself cannot be rolled back without the allocation and will be released at file or connection teardown. Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch. Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup. Found via call-graph analysis using sqry.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.