CVE-2026-31456: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31456 is a race condition vulnerability in the Linux kernel's memory management page-walking subsystem (mm/pagewalk), specifically in walk_pud_range(). The splitting of a PUD (Page Upper Directory) entry can race with a concurrent thread refaulting the PUD leaf entry, causing the kernel to attempt walking a PMD (Page Middle Directory) range that no longer exists, resulting in a kernel panic. Affected versions include Linux kernel 6.12 through 6.18.20, 6.19 through 6.19.10, and 7.0-rc1 through 7.0-rc5. It was published on April 22, 2026, with patches available by May 5, 2026. The CVSS v3.1 base score is 4.7 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367, CWE-362) in walk_pud_range() within the kernel's page table walking code. When one thread splits a PUD entry while another concurrently refaults it back as a leaf entry, walk_pmd_range() proceeds to dereference a PMD range that has been invalidated, triggering an unhandled page fault and kernel oops. A concrete reproduction scenario involves reading /proc/<pid>/numa_maps of a process while VFIO-PCI is executing vfio_pin_pages_remote() on a large BAR (Base Address Register), which causes the race to manifest. The fix validates the PUD entry in walk_pmd_range() using a stable snapshot via pudp_get(), and retries via ACTION_AGAIN if the PUD is absent or is a leaf — mirroring the existing retry logic in walk_pte_range() (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel BUG and system crash, resulting in a denial of service (DoS). There is no confidentiality or integrity impact — the vulnerability exclusively affects availability. The crash manifests as an unhandled page fault at a kernel virtual address (e.g., ffffa23980000000) with a stack trace rooted in walk_pgd_range, and is most likely to occur on systems using VFIO-PCI with large memory BARs or performing concurrent NUMA memory introspection (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and high attack complexity (timing-dependent race condition), limiting its practical exploitability. The EPSS score is approximately 0.017% (2nd percentile), indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing BUG: unable to handle page fault for address followed by stack traces referencing walk_pgd_range, __walk_page_range, walk_page_vma, or show_numa_map.
• Logs: Kernel crash logs showing Oops: 0000 [#1] SMP NOPTI with RIP: 0010:walk_pgd_range+0x3b5/0x7a0 and CR2: ffffa23980000000 (or similar kernel virtual addresses).
• Process: Concurrent access to /proc/<pid>/numa_maps while a VFIO-PCI device is initializing DMA on a large BAR region.
• System: Unexpected system reboots or kernel panics on hosts running VFIO-PCI workloads (e.g., GPU passthrough or SR-IOV environments) (Github Advisory, Red Hat Bugzilla).

Apply the upstream kernel patches available at the stable kernel repository for the affected branches (6.12–6.18.21, 6.19–6.19.11, and 7.0-rc series). Fixed versions include Linux kernel 6.18.21 and 6.19.11. Vendor-specific updates are available from Red Hat, SUSE (SUSE-SU-202621834-1), and Amazon Linux 2023 (ALAS2023-2026-1746, ALAS2023-2026-1816). As a short-term workaround, avoid concurrent reads of /proc/<pid>/numa_maps on processes actively using VFIO-PCI with large BAR regions. Organizations should prioritize patching systems running VFIO-PCI drivers or GPU passthrough workloads (Github Advisory, Red Hat Bugzilla).