CVE-2026-31731: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31731 is a use-after-free vulnerability in the Linux kernel's thermal zone management subsystem, specifically involving a race condition between thermal zone removal and resume operations. The flaw was published on May 1, 2026, and affects Linux kernel versions 6.8 through 6.12.83, 6.13 through 6.18.22, 6.19 through 6.19.12, and 7.0 release candidates (rc1–rc6). It carries a CVSS v3.1 base score of 7.8 (High), requiring only local access and low privileges to exploit (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference) in the Linux kernel thermal core. Two failing scenarios exist: in the first, thermal_zone_pm_complete() re-initializes the poll_queue delayed work for a thermal zone while a work item is already running, causing cancel_delayed_work_sync() in thermal_zone_device_unregister() to miss the running item — if that item continues past the freeing of the thermal zone object, a use-after-free occurs. In the second scenario, thermal_zone_device_resume() (queued by thermal_pm_notify_complete()) runs after thermal_zone_exit() has returned, re-initializing poll_queue before cancel_delayed_work_sync() is called, again allowing work to reference a freed thermal zone object. The fix moves cancel_delayed_work() to thermal_zone_pm_prepare(), introduces a dedicated workqueue with proper flushing in thermal_pm_notify(), and adds a tz->state check in thermal_zone_device_resume() to prevent re-initialization when the zone is being removed (Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to trigger kernel memory corruption via use-after-free, potentially resulting in kernel crashes (denial of service), information disclosure of kernel memory contents, or arbitrary code execution with kernel privileges. The vulnerability affects the confidentiality, integrity, and availability of the system at the kernel level, and could be leveraged for local privilege escalation to root (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access and the ability to trigger concurrent suspend/resume and thermal zone unregister operations, which limits the practical attack surface.

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing use-after-free errors, general protection faults, or kernel BUG/OOPS traces referencing the thermal subsystem (e.g., thermal_zone_device_unregister, thermal_zone_pm_complete, poll_queue).
• Logs: Kernel crash dumps (kdump) or panic messages related to thermal zone work queue operations.
• Process: Unexpected kernel worker threads (kworker) consuming high CPU or hanging in thermal-related code paths.
• File System: Presence of core dump files or crash artifacts in /var/crash/ or /var/lib/systemd/coredump/ following thermal subsystem activity.

Apply the upstream kernel patches available in the mainline Linux kernel repository for the affected stable branches (targeting kernel versions 6.12.83+, 6.18.22+, and 6.19.12+) (Red Hat Bugzilla, Kernel Patch 1). Amazon Linux 2023 users should apply the update referenced in ALAS2023-2026-1746. As a general mitigation, restrict local user access to minimize the privilege level available to potential attackers, and monitor kernel logs for thermal subsystem anomalies. No configuration-based workaround is known; patching is the recommended remediation.