CVE-2026-31646: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31646 is a kernel denial-of-service vulnerability in the Linux kernel's lan966x network driver caused by missing error handling in lan966x_fdma_rx_alloc_page_pool(). When page_pool_create() fails and returns an ERR_PTR, the error pointer is passed unconditionally through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(), where it is dereferenced, triggering a kernel oops. The vulnerability was disclosed on April 24, 2026, and affects Linux kernel versions from 6.2 through multiple stable branches up to (but not including) the patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-252 (Unchecked Return Value) and CWE-476 (NULL Pointer Dereference). In lan966x_fdma_rx_alloc_page_pool(), the return value of page_pool_create() is not validated with an IS_ERR() check before being used in a subsequent loop. Under memory pressure conditions, page_pool_create() returns an error pointer rather than a valid pool object; this error pointer is then passed to xdp_rxq_info_reg_mem_model() and ultimately dereferenced inside page_pool_use_xdp_mem(), causing a kernel oops. The fix adds an IS_ERR() guard immediately after page_pool_create() to return early on failure, preventing the invalid dereference (GitHub Advisory). The attack vector is local (AV:L), requiring low privileges and no user interaction (GitHub Advisory).

Successful exploitation results in a kernel oops and system crash, causing a denial of service (complete loss of availability) on the affected host. There is no confidentiality or integrity impact — the vulnerability is limited to availability. An attacker with local, low-privileged access who can induce memory pressure conditions sufficient to cause page_pool_create() to fail can crash the kernel, rendering the system unavailable until rebooted (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (GitHub Advisory). Exploitation requires local access and the ability to trigger memory pressure, limiting the practical attack surface.

Update the Linux kernel to a patched version for the applicable stable branch: 6.6.135 or later (for 6.2.x–6.6.x), 6.12.82 or later (for 6.7–6.12.x), 6.18.23 or later (for 6.13–6.18.x), 6.19.13 or later (for 6.19.x), or 7.0-rc7 or later for development releases. Patches are available on the stable kernel tree at git.kernel.org. No configuration-based workaround is documented; upgrading to a fixed kernel version is the recommended remediation (GitHub Advisory, Red Hat Bugzilla).