CVE-2026-31562: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31562 is a NULL pointer dereference vulnerability in the Linux kernel's drm/mediatek DSI (Display Serial Interface) driver. It occurs because the mtk_dsi struct is not stored in driver data before mipi_dsi_host_register is invoked, causing a kernel crash during the mtk_dsi_bind callback when it attempts to retrieve the uninitialized structure via dev_get_drvdata. The vulnerability affects Linux kernel versions 6.9 through 6.18.20, 6.19 through 6.19.10, and release candidates up to 7.0-rc7. It was disclosed on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-824 (Access of Uninitialized Pointer). In mtk_dsi_probe, the call to mipi_dsi_host_register triggers a re-entrant callback chain — mtk_dsi_host_attach → mipi_dsi_attach → panel_simple_dsi_probe → mtk_dsi_bind — before dev_set_drvdata has been called to store the mtk_dsi struct. When mtk_dsi_bind calls dev_get_drvdata, it receives a NULL pointer and subsequently crashes at drm_mode_object_add while holding mode_config.idr_mutex, permanently blocking all subsequent DRM operations on the device. The fix requires storing the driver data pointer prior to invoking mipi_dsi_host_register (Red Hat Bugzilla, Kernel Patch 1).

Exploitation of this vulnerability results in a kernel NULL pointer dereference crash that triggers immediately during mediatek-drm driver probe on affected devices. The crash occurs while holding the mode_config.idr_mutex lock, which permanently blocks all subsequent DRM operations and causes complete loss of display functionality. The impact is limited to availability (no confidentiality or integrity loss), and is confined to devices using MediaTek DSI hardware such as the Xiaomi Smart Clock x04g. There is no known potential for lateral movement or data exposure (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability is locally triggered (attack vector: Local, privileges required: Low) and manifests automatically when the mediatek-drm kernel module is loaded on affected hardware. The EPSS score is approximately 0.017%, reflecting very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

The vulnerability has been patched in upstream kernel commits 4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a, 9a709b7e36324dfc1e6728eb81405470b7ae84e5, and df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b. Fixed versions include Linux kernel 6.18.21 and later, 6.19.11 and later, and 7.0-rc8 and later. As a workaround for systems that cannot be immediately patched, avoid loading the mediatek_drm kernel module on affected devices until the update is applied (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).