CVE-2026-31600: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31600 is a memory management vulnerability in the Linux kernel's ARM64 subsystem, specifically in the handling of invalid large leaf mappings in the linear map. The flaw was introduced by commit a166563e7ec37 which added large block mapping support for rodata=full configurations, but various parts of the kernel codebase were not updated to handle invalid large leaf mappings encoded in this new way. It affects Linux kernel versions 6.18 before 6.18.24, 6.19 before 6.19.14, and 7.0 before 7.0.1. The vulnerability was published on April 24, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-372 (Incomplete Internal State Distinction). The ARM64 memory management code has long supported marking page table entries (PTEs) in the linear map as invalid by clearing the PTE_VALID bit — used by features such as secretmem, kfence, and realm DMA memory sharing. However, after commit a166563e7ec37 introduced large block (PMD/PUD-level) mappings for rodata=full, these large leaf entries can also be marked invalid, a state that multiple kernel subsystems (notably the software I/O TLB / swiotlb bounce buffer path) do not correctly handle. On BBML2_NOABORT systems running realm guests, this triggers a level 2 translation fault during swiotlb_bounce → __pi_memcpy_generic when the kernel attempts to copy data through an invalid large leaf mapping, resulting in a kernel panic (GitHub Advisory, Red Hat Bugzilla).

Exploitation of this vulnerability results in a kernel panic and complete system unavailability. The crash occurs during early boot initialization — specifically during virtio network device setup and DMA mapping operations — and terminates the init process (PID 1), causing an unrecoverable kernel panic (Attempted to kill init!). There is no confidentiality or integrity impact; the sole consequence is a total loss of availability for the affected system. Systems most at risk are those running ARM64 hardware with BBML2_NOABORT configurations, rodata=full enabled, and using DMA bounce buffers (e.g., realm guests with memory encryption active) (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.01% (0.000100), indicating a very low probability of exploitation in the near term. The issue manifests as a deterministic kernel panic under specific hardware and configuration conditions (BBML2_NOABORT + rodata=full + DMA bounce buffers) rather than through an externally triggered attack vector, making opportunistic exploitation unlikely (GitHub Advisory).

• Logs: Kernel log entries containing Unable to handle kernel paging request at virtual address ffff000019600000; ESR = 0x0000000096000046; FSC = 0x06: level 2 translation fault; Internal error: Oops: 0000000096000046.
• Logs: Messages indicating software IO TLB: Memory encryption is active and system is using DMA bounce buffers followed immediately by a kernel oops.
• Logs: Call trace including __pi_memcpy_generic, swiotlb_bounce, swiotlb_tbl_map_single, swiotlb_map, dma_map_phys, virtnet_open.
• Logs: Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b indicating the system has crashed unrecoverably.
• System Behavior: System fails to complete boot on ARM64 hardware with rodata=full and DMA bounce buffer configurations; realm guest VMs crash during network device initialization.

Upgrade to a patched Linux kernel version: 6.18.24 or later, 6.19.14 or later, or 7.0.1 or later. Four upstream commits address this issue: 15bfba1ad77fad8e45a37aae54b3c813b33fe27c, 747b6482e4e227fd351197dde6f64a97107a9e52, 8140b21d19015227a28c255404462f2d3e6edc9a, and cbea627ea634f41c79d18f0c6d20db66fa93514c. As a temporary workaround for systems that cannot be immediately patched, disabling the rodata=full kernel configuration option can prevent the vulnerable code path from being triggered, since the issue only arises when large block mappings are created for read-only data sections (GitHub Advisory, Red Hat Bugzilla).

Red Hat has filed a tracking bug (Bugzilla #2461514) and classified the issue as medium severity. The upstream kernel security team published an advisory via the linux-cve-announce mailing list. No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability tracking (Red Hat Bugzilla).