CVE-2026-31526: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31526 is a lock validation bypass vulnerability in the Linux kernel's BPF subsystem, specifically in the exception exit handling for BPF subprograms. When bpf_throw() is called from a static subprogram, process_bpf_exit_full() incorrectly passes check_lock = false to check_resource_leak(), causing the verifier to skip validation of active_rcu_locks, active_preempt_locks, and active_irq_id on exception exits. This allows BPF programs to leave locks unreleased at runtime when bpf_throw() unwinds the stack via ORC. Affected versions include Linux kernel 6.7 through 6.18.20, 6.19 through 6.19.10, and 7.0-rc1 through 7.0-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-667 (Improper Locking). In process_bpf_exit_full(), the expression check_lock = !curframe evaluates to false when bpf_throw() is invoked from a static subprogram (i.e., when curframe is non-zero), causing check_resource_leak() to bypass lock validation for RCU, preempt, and IRQ locks. At runtime, bpf_throw() performs stack unwinding via ORC without releasing any user-acquired locks, since exceptions bypass all intermediate frame cleanup. Exploitation requires local access and low privileges — an attacker or unprivileged user with BPF program loading capability could craft a BPF program that calls bpf_throw() from a static subprog while holding locks, causing them to remain unreleased (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in lock leaks that cause system instability and resource exhaustion, with a high availability impact. Unreleased RCU, preempt, or IRQ locks can lead to deadlock conditions, kernel hangs, or improper resource cleanup, potentially rendering the affected system unresponsive. There is no confidentiality or integrity impact; the primary risk is denial of service at the kernel level (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (GitHub Advisory). The vulnerability requires local access with low privileges (e.g., the ability to load BPF programs), limiting its attack surface. The EPSS score is approximately 0.014% (2nd percentile), indicating a very low probability of exploitation in the near term. CVE-2026-31526 is not listed in the CISA Known Exploited Vulnerabilities catalog.

Update to patched Linux kernel versions: 6.18.21 or later, 6.19.11 or later, or 7.0 (stable) or later. Stable fixes are available via the following upstream commits: 5a399f3117642494e35545f6ca397d3e177c1f9b, 6c2128505f61b504c79a20b89596feba61388112, and c0281da1f2aa5c2fca3a05f79b86bea96591c358. As a workaround where patching is not immediately possible, consider disabling unprivileged BPF program loading (sysctl -w kernel.unprivileged_bpf_disabled=1) or disabling BPF functionality entirely if not required. Amazon Linux 2023 users should apply ALAS2023-2026-1746, and SUSE users should apply SUSE-SU-202621834-1 (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported via the standard Linux kernel CVE announcement process by Greg Kroah-Hartman and tracked by Red Hat's Product Security team. No notable public researcher commentary or significant media coverage has been identified beyond standard vulnerability database entries and vendor patch advisories.