CVE-2026-31744: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31744 is a NULL pointer dereference vulnerability in the Linux kernel's Power Management Energy Model (PM: EM) subsystem. It affects the dev_energymodel_nl_get_perf_domains_doit() function, which fails to validate the return value of em_perf_domain_get_by_id() before passing it to __em_nl_get_pd_size(). When a caller supplies a non-existent performance domain ID via a netlink message, the function receives a NULL pointer and immediately dereferences pd->cpus at struct offset 0x30, triggering a kernel panic. Affected versions include Linux kernel 6.19.1 through 6.19.11 and release candidates for 6.19 and 7.0. It was published on May 1, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-252 (Unchecked Return Value). The dev_energymodel_nl_get_perf_domains_doit() handler calls em_perf_domain_get_by_id() but does not check whether the returned pointer is NULL before passing it to __em_nl_get_pd_size(), which immediately dereferences pd->cpus (struct offset 0x30). The sister handler dev_energymodel_nl_get_perf_table_doit() already handles this correctly by checking for NULL via __em_nl_get_pd_table_id() and returning -EINVAL. Exploitation requires local access and low privileges — an attacker sends a crafted netlink message to the energy model interface specifying a non-existent performance domain ID (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic or system hang — a complete denial of service for the affected host. The impact is limited to availability (no confidentiality or integrity impact), and the vulnerability is locally scoped with no potential for lateral movement or data exfiltration. Any local user with low privileges capable of sending netlink messages to the energy model interface can crash the system (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term (Red Hat Advisory).

1. Identify target: Confirm the target system is running a vulnerable Linux kernel version (6.19.1–6.19.11 or 7.0-rc1 through 7.0-rc7) with the energy model netlink interface available.
2. Gain local access: Obtain a local shell with low-privilege user access on the target system.
3. Craft netlink message: Construct a netlink message targeting the energy model interface (dev_energymodel_nl_get_perf_domains_doit()) and specify a non-existent performance domain ID in the request payload.
4. Send the message: Transmit the crafted netlink message to the kernel's energy model netlink socket.
5. Trigger NULL dereference: The kernel calls em_perf_domain_get_by_id() with the invalid ID, receives NULL, and passes it unchecked to __em_nl_get_pd_size(), which dereferences pd->cpus at offset 0x30, causing a kernel panic and system crash (Red Hat Bugzilla).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing a NULL pointer dereference in __em_nl_get_pd_size() or dev_energymodel_nl_get_perf_domains_doit(); stack traces involving the PM/EM subsystem.
• System Behavior: Unexpected system reboots or kernel panics on systems with the energy model netlink interface enabled, particularly on ARM or heterogeneous CPU platforms using the Energy Model framework.
• Network/IPC: Unusual or repeated netlink socket activity from low-privilege processes targeting the energy model interface, observable via strace or audit logs.

Apply kernel updates to version 6.19.12 or later, which includes the fix adding a NULL check in dev_energymodel_nl_get_perf_domains_doit() before passing the result of em_perf_domain_get_by_id() to __em_nl_get_pd_size(). The specific upstream fixes are available in kernel commits 9badc2a84e688be1275bb740942d5f6f51746908 and ab09b9a1e3b02ff62c5aebe3b12b0cb4cb4ea8ab. As a workaround, restrict access to the energy model netlink interface using Linux Security Modules (e.g., SELinux, AppArmor) or capability restrictions to limit which users can send netlink messages to this interface (Red Hat Advisory, Red Hat Bugzilla).