CVE-2026-31689: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31689 is an error path ordering flaw in the Linux kernel's EDAC/mc (Error Detection and Correction/Memory Controller) subsystem, specifically in the edac_mc_alloc() function. When the mci->pvt_info memory allocation fails, the error path invokes put_device() before device_initialize() has been called, resulting in attempts to dereference uninitialized pointers and call an unset release function pointer. The vulnerability affects Linux kernel versions from 5.19 through multiple stable branches up to 7.0-rc7. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-824 (Access of Uninitialized Pointer) and CWE-476 (NULL Pointer Dereference). In edac_mc_alloc(), the original code called device_initialize() after the mci->pvt_info allocation, meaning that if the allocation failed, the error path would invoke put_device() — and transitively kobject_put() — on a device structure whose kobject had never been initialized. The fix reorders the initialization sequence so that device_initialize() is called before any allocation that could fail, ensuring the release function pointer is valid before it can be invoked. The bug was discovered by Claude AI while reviewing another EDAC patch (GitHub Advisory).

Exploitation of this vulnerability is limited to availability impact — there is no confidentiality or integrity risk. A local user with low privileges can trigger the flaw during AMD64 EDAC driver initialization under memory pressure conditions, causing kernel warnings about uninitialized kobjects being freed and potentially leading to system instability or crashes (denial of service). The scope is limited to the local system, with no potential for lateral movement or data exposure (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term. The attack requires local access with low privileges and is contingent on a memory allocation failure during EDAC driver initialization, making opportunistic exploitation unlikely (GitHub Advisory).

• Logs: Kernel log entries containing kobject: '(null)': is not initialized, yet kobject_put() is being called. or WARNING: lib/kobject.c:734 at kobject_put during system boot or EDAC module loading.
• Logs: Kernel call traces referencing edac_mc_alloc in edac_core and amd64_edac_init in amd64_edac modules.
• Process: Unexpected kernel warnings or oops messages triggered by systemd-udevd or similar processes during hardware initialization on AMD64 systems with EDAC support.

Apply the available kernel patches for the relevant stable branch. Fixed versions include: 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0 (stable). Patches are available via the Linux kernel stable tree at multiple commits (e.g., 51520e03, 75825648, 87ce8ae5, aae95970, d20e98c2, d3de72e2). There is no known configuration-based workaround; upgrading to a patched kernel version is the recommended remediation. Administrators should prioritize updates on systems running AMD64 hardware with EDAC drivers loaded (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was noted as having been discovered by Claude AI during a code review of an unrelated EDAC patch, which drew minor attention as an example of AI-assisted vulnerability discovery in the Linux kernel. Community reaction has been muted given the low severity and limited exploitability of the flaw. No significant vendor statements or media coverage beyond standard advisory publication have been observed (GitHub Advisory).