CVE-2026-31540: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31540 Overview

CVE-2026-31540 is a NULL pointer dereference vulnerability in the Linux kernel's Intel i915 Graphics Processing Unit (GPU) driver. The flaw resides in the drm/i915/gt subsystem, where the set_default_submission function pointer is dereferenced during system suspend without verifying it was initialized. When the i915 driver firmware binaries are not present on the system, this pointer remains unset, leading to a kernel oops at suspend time. The issue is tracked under [CWE-476: NULL Pointer Dereference] and affects multiple stable Linux kernel branches including 7.0-rc1 through 7.0-rc4.

Critical Impact
A local user can trigger a kernel crash during system suspend on Intel graphics hardware lacking required firmware binaries, resulting in a denial of service condition.

Affected Products

Linux Kernel (multiple stable branches)
Linux Kernel 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4
Systems using the Intel i915 DRM driver without required GuC/HuC firmware binaries

Discovery Timeline

2026-04-24 - CVE-2026-31540 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31540

Vulnerability Analysis

The vulnerability exists in the Direct Rendering Manager (DRM) i915 graphics driver, specifically within the GPU GT (Graphics Translation) suspend path. During system suspend, the kernel invokes intel_engines_reset_default_submission(), which iterates over the engines and calls each engine's set_default_submission callback. When the i915 firmware binaries (such as GuC firmware) are missing, the submission backend is never fully initialized and the set_default_submission function pointer remains NULL.

The call chain leading to the crash traverses i915_drm_suspend_late() → i915_gem_suspend_late() → gt_sanitize() → intel_gt_unset_wedged() → __intel_gt_unset_wedged() → intel_engines_reset_default_submission(). The unconditional dereference of the function pointer at this stage produces a kernel oops with RIP: 0010:0x0, indicating an attempt to execute code at address zero.

Root Cause

The root cause is the absence of a guard check before dereferencing the set_default_submission callback. The i915 driver assumes the submission backend is always initialized, but this assumption fails when firmware binaries cannot be loaded. The fix adds a presence check to confirm the pointer is non-NULL before invoking it.

Attack Vector

Exploitation requires local access to a system running an affected Linux kernel on Intel graphics hardware without the necessary firmware files installed. A local user triggering system suspend, or an automatic suspend event, causes the kernel to dereference the NULL function pointer and crash. The CVSS vector indicates a local attack vector with low privileges required and high availability impact, with no impact to confidentiality or integrity.

No verified public exploit code exists. The vulnerability manifests as a deterministic kernel panic during the suspend code path rather than a memory corruption primitive suitable for privilege escalation. Refer to the upstream commits referenced in the Linux kernel stable tree for the exact source-level fix.

Detection Methods for CVE-2026-31540

Indicators of Compromise

Kernel oops messages referencing intel_engines_reset_default_submission+0x42/0x60 in dmesg or /var/log/kern.log.
BUG: kernel NULL pointer dereference, address: 0000000000000000 entries occurring during PM suspend transitions.
Call traces involving i915_gem_suspend_late, gt_sanitize, and __intel_gt_unset_wedged immediately preceding a crash.
Missing i915 GuC/HuC firmware warnings in kernel boot logs on Intel graphics hosts.

Detection Strategies

Monitor kernel logs for repeated suspend-time panics on workstations and laptops with Intel integrated graphics.
Inventory Linux endpoints to identify systems running kernel versions 7.0-rc1 through 7.0-rc4 or other branches referenced in the upstream commits.
Verify presence of required firmware files under /lib/firmware/i915/ on Intel graphics hosts.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging platform and alert on NULL pointer dereference paired with i915 symbols.
Track abnormal system reboot patterns following suspend/resume cycles on fleets with Intel graphics.
Audit firmware package installation status (for example, linux-firmware) across managed Linux endpoints.

How to Mitigate CVE-2026-31540

Immediate Actions Required

Apply the upstream patches referenced in the kernel.org commit list to all affected Linux kernel branches.
Install the appropriate linux-firmware package so the i915 driver loads its required GuC/HuC binaries.
Where patching is delayed, restrict use of suspend on affected hosts until the kernel update is applied.

Patch Information

The fix adds a NULL check on the set_default_submission pointer before dereferencing it inside intel_engines_reset_default_submission(). The patch was cherry-picked from upstream commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad and backported across multiple stable branches. Reference commits include 0162ab32, 1a161507, 2e20a886, cf4b224f, da6552d6, db8b1beb, and df1f4a7d.

Workarounds

Install the distribution linux-firmware package to provide the i915 GuC/HuC firmware and avoid the uninitialized submission backend state.
Disable suspend-to-RAM on affected hosts via systemctl mask sleep.target suspend.target until the kernel is patched.
Blacklist the i915 module on headless servers where graphics is not required, using /etc/modprobe.d/blacklist-i915.conf.

bash

# Configuration example
# Install required firmware (Debian/Ubuntu)
sudo apt-get install --reinstall linux-firmware

# Verify i915 firmware files are present
ls -l /lib/firmware/i915/

# Temporary workaround: mask suspend targets until patched kernel is deployed
sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target