CVE-2026-31544 Overview
CVE-2026-31544 is a NULL pointer dereference vulnerability [CWE-476] in the Linux kernel's ARM System Control and Management Interface (SCMI) firmware driver. The flaw resides in the __scmi_event_handler_get_ops helper function within firmware/arm_scmi. After commit b5daf93b809d1, callers expect this helper to return an ERR_PTR on failure, but the function can still return NULL when no handler is found or created. A local, authenticated attacker can trigger the dereference through the notifier registration path, causing a kernel crash and denial of service on the affected system.
Critical Impact
Local users can trigger a kernel NULL pointer dereference in the arm_scmi notify error path, leading to system crash and high availability impact on ARM-based Linux systems.
Affected Products
- Linux Kernel 7.0-rc1 through 7.0-rc5
- Linux Kernel branches containing commit b5daf93b809d1
- ARM-based systems using the arm_scmi firmware driver for SCMI notifications
Discovery Timeline
- 2026-04-24 - CVE-2026-31544 published to NVD
- 2026-04-28 - Last updated in NVD database
Technical Details for CVE-2026-31544
Vulnerability Analysis
The vulnerability exists in the ARM SCMI firmware driver, which provides a standardized interface for system management operations on ARM platforms. SCMI exposes notifications that drivers can subscribe to through a notifier registration mechanism.
Commit b5daf93b809d1 ("firmware: arm_scmi: Avoid notifier registration for unsupported events") changed the contract for the internal helper __scmi_event_handler_get_ops. Callers now expect the helper to return an ERR_PTR value when it cannot resolve a handler for a requested event key. The helper itself was not updated to honor this contract and can still return a raw NULL value when no matching handler exists or one cannot be created.
Downstream code paths use the IS_ERR macro to validate the returned pointer. A NULL return value bypasses this check because IS_ERR(NULL) evaluates to false. The kernel then dereferences the NULL pointer when attempting to invoke handler operations, triggering an oops and impacting system availability.
Root Cause
The root cause is an inconsistent error reporting contract between __scmi_event_handler_get_ops and its callers. The helper mixes two error-signaling conventions, returning NULL in some failure paths and ERR_PTR values in others. Callers validate only against IS_ERR, leaving NULL returns unhandled and exposing the dereference [CWE-476].
Attack Vector
Exploitation requires local access with low privileges on a system running an affected kernel on ARM hardware with SCMI support. An attacker triggers the vulnerable code path by causing notifier registration for an event that the SCMI platform cannot service. The resulting NULL dereference produces a kernel panic or oops, denying service to the affected host. The vulnerability does not provide a path to code execution or information disclosure based on the published analysis.
No public proof-of-concept exploit is available. The patch reference commits are 555317d6100164748f7d09f80142739bd29f0cda, 70d9bd9a2e683afe6200b0c20af22f06f1a199a4, and 8414d2800c34528467df23ce6192c254a73e4459.
Detection Methods for CVE-2026-31544
Indicators of Compromise
- Kernel oops or panic messages referencing __scmi_event_handler_get_ops, scmi_notifier_register, or related symbols in the arm_scmi module
- Unexpected system reboots or crashes on ARM hosts following driver initialization or module load events
- dmesg entries containing NULL pointer dereference traces with SCMI subsystem frames
Detection Strategies
- Inventory ARM-based Linux systems and identify kernels built from 7.0-rc1 through 7.0-rc5 or any tree containing commit b5daf93b809d1 without the fix
- Parse kernel crash dumps and kdump output for stack traces that include arm_scmi notifier registration frames
- Correlate repeated kernel crashes on ARM hosts with recent driver loads, firmware updates, or workloads that exercise SCMI notifications
Monitoring Recommendations
- Forward /var/log/kern.log and journald kernel facility events to a centralized logging platform for crash pattern analysis
- Alert on kernel panic events and NULL pointer dereference signatures from ARM server fleets
- Track kernel package versions across the fleet and flag hosts running unpatched 7.0-rc kernels
How to Mitigate CVE-2026-31544
Immediate Actions Required
- Upgrade the Linux kernel to a version that includes the fix from commits 555317d, 70d9bd9, or 8414d28
- Audit ARM-based hosts running release candidate kernels and prioritize patching for systems exposed to multi-tenant or untrusted local users
- Restrict local shell access on affected systems until kernels are updated, since exploitation requires local privileges
Patch Information
The upstream fix forces __scmi_event_handler_get_ops to return an ERR_PTR value when the handler reference is NULL, aligning the helper with the contract expected by all callers. Patches are available in the stable tree at Kernel Git Commit 555317d, Kernel Git Commit 70d9bd9, and Kernel Git Commit 8414d28.
Workarounds
- Disable the arm_scmi driver on systems that do not require SCMI notifications by blacklisting the module
- Limit local account creation and enforce least-privilege policies to reduce the population of users who can trigger the vulnerable code path
- Apply distribution-provided kernel updates as soon as backported fixes become available
# Verify running kernel version and check for arm_scmi module usage
uname -r
lsmod | grep arm_scmi
# Optional: blacklist the arm_scmi module where not required
echo "blacklist arm_scmi" | sudo tee /etc/modprobe.d/blacklist-arm_scmi.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
