CVE-2026-31559: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31559 is a NULL pointer dereference vulnerability in the Linux kernel's LoongArch architecture subsystem, caused by missing NULL checks for the return value of kstrdup() during early boot CPU model parsing from the device tree. It was published on April 24, 2026, and affects Linux kernel versions 6.12.43 through 6.12.79, 6.15.11 through 6.15.x, 6.16.2 through 6.16.x, 6.17.1 through 6.18.20, 6.19 through 6.19.10, and pre-release 7.0 release candidates (rc1–rc7). The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), with local attack vector and high availability impact (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) arising from the failure to validate the return value of kstrdup() in the LoongArch-specific CPU model parsing code. When memory allocation fails during early boot — a scenario possible under memory pressure — kstrdup() returns NULL, and the subsequent use of that pointer without a NULL check triggers a kernel oops. The fix also replaces of_find_node_by_path("/") with the direct of_root reference to eliminate redundant of_node_put() calls that could cause additional reference-counting issues. Exploitation requires local access with low privileges and is limited to LoongArch hardware platforms (Red Hat Bugzilla, Red Hat Advisory).

Successful triggering of this vulnerability causes a kernel oops during early boot, potentially preventing the affected LoongArch system from booting successfully. The impact is limited to availability — there is no confidentiality or integrity impact — and is confined to the local system without scope change. Systems under memory pressure at boot time are most at risk of encountering this condition (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.02%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local, low-privileged users on LoongArch hardware, significantly limiting the practical attack surface (Red Hat Advisory).

Patches are available in the following fixed Linux kernel versions: 6.12.80, 6.18.21, 6.19.11, and 7.0. Administrators running LoongArch systems on affected kernel versions (6.12.43–6.12.79, 6.15.11–6.15.x, 6.16.2–6.16.x, 6.17.1–6.18.20, 6.19–6.19.10) should upgrade to a patched release as the primary remediation. No configuration-based workaround is available; upgrading the kernel is the only effective mitigation (Red Hat Advisory, Red Hat Bugzilla).