CVE-2026-31482: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31482 is a register scrubbing flaw in the Linux kernel affecting the s390 architecture, where the r12 register is not properly cleared during kernel entry. The vulnerability was introduced when commit f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP") removed the branch prediction macros and the associated r12 load but failed to add r12 to the register clearing sequence. It was publicly disclosed on April 22, 2026, and affects Linux kernel versions 6.4.1 through 6.6.130, 6.7 through 6.12.79, 6.13 through 6.18.20, 6.19 through 6.19.10, and 7.0-rc1 through 7.0-rc7. The CVSS v3.1 base score is 5.5 (Medium), with a local attack vector and low privilege requirement (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-909 (Missing Initialization of Resource). Before commit f33f2d4c7c80, all s390 kernel entry handlers loaded register r12 with the current task pointer (lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT branch prediction macros. When that commit removed TIF_ISOLATE_BP and the associated macros, it omitted adding r12 to the register scrubbing sequence, leaving potentially sensitive data in r12 accessible across the user-kernel boundary. The fix adds a single xgr %r12,%r12 instruction to zero out r12 consistently across all s390 kernel entry points (GitHub Advisory).

A local attacker with low privileges on an s390 system could potentially read sensitive data left in the r12 register during kernel entry transitions, resulting in an information disclosure risk. The CVSS assessment indicates no confidentiality or integrity impact at the kernel level, but rates availability impact as High, suggesting the uninitialized register state could also contribute to system instability under certain conditions. The vulnerability is scoped to s390 architecture systems only and does not affect other kernel architectures (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and is limited to s390 architecture systems.

Patches are available across multiple stable kernel branches. Users should upgrade to the following fixed versions based on their current branch: 6.6.131 (for 6.4.1–6.6.130), 6.12.80 (for 6.7–6.12.79), 6.18.21 (for 6.13–6.18.20), 6.19.11 (for 6.19–6.19.10), or 7.0 stable release (for 7.0-rc1 through 7.0-rc7). For systems that cannot be immediately patched, restrict local user access on s390 systems and monitor for suspicious activity. Prioritize patching s390 production systems running affected kernel versions (GitHub Advisory, Red Hat Bugzilla).