CVE-2026-31481: Linux Kernel Tracing DoS Vulnerability

CVE-2026-31481 Overview

A NULL pointer dereference vulnerability has been identified in the Linux kernel's tracing subsystem. The flaw exists in the trigger-data cleanup mechanism where boot-time trigger registration can fail before the trigger-data cleanup kthread exists. When kthread creation fails, deferred trigger frees are not properly drained, leading to memory leaks and a NULL pointer dereference that can crash the kernel.

Critical Impact

This vulnerability can cause a kernel crash through NULL pointer dereference when specific tracing trigger configurations are used during boot, potentially leading to denial of service conditions on affected Linux systems.

Affected Products

• Linux Kernel (versions with affected tracing subsystem)

Discovery Timeline

• 2026-04-22 - CVE-2026-31481 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31481

Vulnerability Analysis

The vulnerability resides in the Linux kernel's tracing subsystem, specifically in how deferred trigger frees are handled during boot-time initialization. When trigger-data registration fails before the cleanup kthread is created, the system attempts to defer the cleanup operation. However, the post-boot fallback mechanism fails to properly drain the deferred list when kthread creation never succeeds.

This results in boot-deferred nodes accumulating on trigger_data_free_list. Subsequent free operations fall back to synchronously freeing only the current object, while older queued entries remain stranded on the list, causing a memory leak. More critically, under specific trigger configurations, this leads to a NULL pointer dereference that crashes the kernel.

Root Cause

The root cause is improper handling of the deferred trigger free list when the cleanup kthread fails to initialize. The kernel fails to drain queued entries from trigger_data_free_list when kthread creation is unsuccessful, leaving dangling references that eventually cause a NULL pointer dereference when accessed.

Attack Vector

The vulnerability can be triggered by adding specific kernel command line parameters during boot:

trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon

When the second traceon trigger fails and is freed, it triggers a NULL pointer dereference and crashes the kernel. This requires local access to modify boot parameters or the ability to influence kernel command line configuration.

The fix implements proper drainage of the deferred boot-time list when kthread creation fails, ensuring all queued entries are synchronously freed rather than left stranded. The same synchronous drain logic is applied in the late-init drain path to prevent entries from being stranded there as well.

Detection Methods for CVE-2026-31481

Indicators of Compromise

• Kernel panic or crash logs indicating NULL pointer dereference in tracing subsystem functions
• System boot failures when specific trace_event and trace_trigger parameters are configured
• Memory leak patterns related to trigger_data_free_list in kernel memory diagnostics

Detection Strategies

• Monitor kernel logs for NULL pointer dereference errors related to tracing or trigger functions
• Audit kernel command line configurations for potentially problematic trace_trigger parameters
• Use kernel debugging tools such as dmesg to identify crashes in the tracing subsystem
• Implement automated boot testing with various tracing configurations to detect issues early

Monitoring Recommendations

• Enable kernel crash dump analysis to capture and analyze NULL pointer dereference events
• Monitor system uptime and unexpected reboots that may indicate kernel crashes
• Review boot logs for failed trigger registrations or kthread creation failures

How to Mitigate CVE-2026-31481

Immediate Actions Required

• Review and remove any unnecessary trace_event and trace_trigger boot parameters from kernel command line
• Apply the available kernel patches to affected systems
• Monitor systems for unexpected crashes or reboots until patches can be applied

Patch Information

The vulnerability has been addressed through patches committed to the Linux kernel stable tree. The fix ensures that when kthread creation fails, the entire deferred list is drained synchronously, preventing memory leaks and NULL pointer dereferences. Additionally, the late-init drain path has been updated with the same logic.

Patches are available at:

• Kernel Git Commit 250ab253
• Kernel Git Commit 771624b7

Workarounds

• Avoid using multiple conflicting trace_trigger configurations on the same event during boot
• Remove trace_event and trace_trigger parameters from kernel command line until patches are applied
• If tracing functionality is not required, consider disabling tracing-related kernel options entirely

# Review current kernel command line for tracing parameters
cat /proc/cmdline | grep -E "trace_event|trace_trigger"

# If found, modify bootloader configuration to remove problematic parameters
# For GRUB, edit /etc/default/grub and remove trace_event/trace_trigger entries
# Then regenerate GRUB configuration:
sudo update-grub