CVE-2026-31542: Linux Kernel DoS Vulnerability

CVE-2026-31542 Overview

CVE-2026-31542 is a denial-of-service vulnerability in the Linux kernel's x86/platform/uv subsystem, which supports SGI UV (Ultraviolet) large-scale NUMA hardware. When a socket is deconfigured, the kernel maps it to SOCK_EMPTY (0xffff), causing a panic during allocation of UV hub info structures. Successful triggering of the bug crashes the host, impacting availability on affected systems.

The issue affects Linux kernel 7.0 release candidates (rc1 through rc4) and related stable branches. The flaw requires local, low-privileged access, and there is no impact to confidentiality or integrity.

Critical Impact
Triggering the deconfigured-socket path causes a kernel panic, terminating workloads on UV-class NUMA hardware and forcing a reboot.

Affected Products

Linux kernel 7.0-rc1 through 7.0-rc4
Linux kernel stable branches referenced in the upstream fix commits
Systems using SGI UV (x86/platform/uv) hardware platforms

Discovery Timeline

2026-04-24 - CVE-2026-31542 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31542

Vulnerability Analysis

The vulnerability resides in the SGI UV platform support code in arch/x86/platform/uv. The UV subsystem allocates hub information structures keyed to NUMA node identifiers derived from physical socket IDs. When the firmware reports a deconfigured socket, the platform code maps that socket to the sentinel value SOCK_EMPTY (0xffff).

The allocation path then attempts to use this sentinel as if it were a valid NUMA node index. The resulting out-of-range node lookup leads to a kernel panic during system initialization or hub info setup. The CWE is recorded as NVD-CWE-noinfo, but the behavior aligns with improper handling of a special return value in a kernel allocator path.

The upstream resolution replaces the invalid sentinel with NUMA_NO_NODE, instructing the allocator to choose any valid node rather than dereferencing the placeholder.

Root Cause

The root cause is the use of SOCK_EMPTY (0xffff) as a node identifier when allocating UV hub info structures. The allocator does not treat 0xffff as an invalid or unmapped node, so the allocation proceeds against a non-existent NUMA node and triggers a panic.

Attack Vector

This is a local availability issue. An attacker with local low-privileged access to a UV-class system, or a system reaching the affected code path during boot or hot-plug operations involving deconfigured sockets, can induce a kernel panic. There is no network-reachable component, no remote code execution, and no data disclosure.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-31542

Indicators of Compromise

Unexpected kernel panic messages referencing uv_hub_info, alloc_pages_node, or NUMA node allocation on SGI UV hardware
System logs showing socket-to-node mappings containing the value 0xffff (SOCK_EMPTY) prior to a crash
Repeated boot failures or reboots on UV platforms after firmware changes that deconfigure sockets

Detection Strategies

Inventory hosts running Linux kernel 7.0-rc1 through 7.0-rc4 and any stable branches that have not yet incorporated the referenced upstream commits
Correlate kernel crash dumps with the x86/platform/uv call path using kdump or crash analysis
Audit firmware and BIOS configurations on UV-class systems for deconfigured sockets that could trigger the affected code path

Monitoring Recommendations

Forward kernel ring buffer and dmesg output to a centralized log platform and alert on Kernel panic events tied to UV subsystem symbols
Track kernel package versions across the fleet and flag hosts still running pre-patch builds
Monitor system uptime and unexpected reboot events on large NUMA hardware where UV code paths are active

How to Mitigate CVE-2026-31542

Immediate Actions Required

Apply the upstream Linux kernel patches that replace the SOCK_EMPTY sentinel with NUMA_NO_NODE in the UV hub allocation path
Update to a kernel build that includes the fix commits referenced in the vendor advisories
Restrict local access to UV-class systems to trusted administrative users while patching is in progress

Patch Information

The vulnerability is resolved in the Linux kernel by the following commits, which adjust UV hub info allocation to use NUMA_NO_NODE for deconfigured sockets:

Distribution-provided kernel updates incorporating these commits should be deployed through standard package management workflows.

Workarounds

Ensure all sockets are configured in firmware so the deconfigured-socket code path is not exercised
Limit local shell access on affected UV hardware to reduce exposure until patches are applied
Schedule controlled reboots into patched kernels rather than relying on live mitigation, as the issue manifests during hub info allocation