CVE-2026-31562: Linux Kernel DOS Vulnerability

CVE-2026-31562 Overview

CVE-2026-31562 is a Null Pointer Dereference vulnerability in the Linux kernel's MediaTek DRM DSI (Display Serial Interface) driver. The vulnerability exists in the drm/mediatek display subsystem where the driver data is not properly stored before invoking mipi_dsi_host_register. This results in a kernel crash when the callback function mtk_dsi_bind attempts to retrieve the mtk_dsi struct using dev_get_drvdata, which returns an uninitialized (NULL) pointer.

Critical Impact
Local attackers can trigger a kernel NULL pointer dereference during MediaTek DRM driver initialization, causing a complete system crash and blocking all subsequent DRM operations.

Affected Products

Linux Kernel versions prior to 6.9 (stable branches)
Linux Kernel 6.9
Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

2026-04-24 - CVE CVE-2026-31562 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31562

Vulnerability Analysis

This vulnerability is classified under CWE-476 (Null Pointer Dereference). The flaw occurs during the MediaTek DRM driver probe process when initializing the DSI display interface. The core issue is a race condition in the initialization sequence where mipi_dsi_host_register is called before the driver data structure is properly stored.

When mipi_dsi_host_register is invoked, it triggers a callback chain that ultimately calls mtk_dsi_bind. This function relies on dev_get_drvdata to retrieve the mtk_dsi structure containing essential driver state. However, since the driver data has not been stored yet at this point in the initialization sequence, dev_get_drvdata returns NULL, leading to a kernel crash when the code attempts to dereference this NULL pointer.

The crash occurs specifically when registering the DSI DRM encoder after acquiring mode_config.idr_mutex, which results in blocking all subsequent DRM operations on the system.

Root Cause

The root cause is an improper initialization order in the mtk_dsi_probe function within the MediaTek DRM DSI driver. The call to dev_set_drvdata (which stores the driver data) must occur before mipi_dsi_host_register is invoked. The original code called mipi_dsi_host_register before storing the driver data, creating a window where callbacks could access uninitialized memory.

This is a classic initialization ordering bug where the registration of a subsystem component triggers callbacks that depend on data not yet available, resulting in undefined behavior and system instability.

Attack Vector

The vulnerability requires local access to the system and can be triggered during the kernel module loading process. An attacker with the ability to load kernel modules or trigger device driver initialization could exploit this vulnerability to cause a denial of service condition.

The attack vector involves triggering the MediaTek DRM driver probe sequence, which can occur during:

System boot when MediaTek display hardware is detected
Manual loading of the mediatek_drm kernel module
Hot-plugging of display devices that trigger driver initialization

The kernel crash produces a call trace starting from drm_mode_object_add through __drm_encoder_init, mtk_dsi_bind, and ultimately back to mipi_dsi_host_register in the mtk_dsi_probe function.

Detection Methods for CVE-2026-31562

Indicators of Compromise

Kernel panic logs showing "Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040"
System crash traces containing mtk_dsi_bind, drm_mode_object_add, or __drm_encoder_init in the call stack
Repeated MediaTek DRM driver initialization failures in system logs
Unexpected system reboots on devices with MediaTek display hardware

Detection Strategies

Monitor kernel logs (dmesg) for NULL pointer dereference errors in the DRM subsystem
Implement kernel crash dump analysis to identify crashes originating from mediatek_drm module
Track module loading events for mediatek_drm and correlate with system stability issues
Deploy kernel crash monitoring tools to capture and alert on DRM-related kernel panics

Monitoring Recommendations

Enable kernel panic logging and core dump collection for post-incident analysis
Configure watchdog timers to detect and recover from kernel hangs caused by DRM mutex blocking
Monitor system uptime metrics for devices with MediaTek display controllers
Implement automated alerting for kernel oops messages containing MediaTek DRM components

How to Mitigate CVE-2026-31562

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix
If immediate patching is not possible, consider blacklisting the mediatek_drm module if display functionality is not required
Monitor affected systems for crash events and plan maintenance windows for kernel updates
Review system logs on MediaTek-based devices for evidence of exploitation attempts

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that dev_set_drvdata is called before mipi_dsi_host_register, properly initializing the driver data structure before any callbacks can access it.

Patches are available through the following kernel git commits:

Workarounds

Blacklist the mediatek_drm module by adding blacklist mediatek_drm to /etc/modprobe.d/blacklist.conf if display functionality is not needed
Use an alternative display driver if available for the specific hardware
Implement module loading restrictions to prevent untrusted users from triggering driver initialization

bash

# Blacklist the vulnerable module as a temporary workaround
echo "blacklist mediatek_drm" >> /etc/modprobe.d/blacklist.conf
update-initramfs -u