CVE-2026-31753: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31753 is a NULL pointer dereference vulnerability in the Linux kernel's auxdisplay line-display driver (linedisp_release()). The flaw occurs when the linedisp_release() function attempts to retrieve the enclosing struct linedisp via to_linedisp(), which depends on the attachment list — but the attachment may already have been removed before put_device() invokes the release callback, causing a NULL dereference. It affects Linux kernel versions in the 6.19 series (prior to 6.19.12) and 7.0 release candidates (rc1 through rc6) (GitHub Advisory, Red Hat Bugzilla). The vulnerability was published on May 1, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is a NULL pointer dereference (CWE-476) in the linedisp_release() function within the Linux kernel's auxdisplay/line-display subsystem. The function uses to_linedisp() to look up the enclosing struct linedisp via the device attachment list; however, during linedisp_unregister() or certain linedisp_register() error paths, the attachment may already be removed before put_device() triggers the release callback, causing to_linedisp() to return NULL. The fix replaces the attachment-list-dependent lookup with a direct container_of() call on the embedded linedisp->dev, which is always valid in this context (GitHub Advisory, Red Hat Bugzilla). Exploitation requires local access with low privileges and no user interaction.

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and denial of service (system crash). The impact is limited to availability — there is no confidentiality or integrity impact — and affects only systems with the auxdisplay line-display driver loaded, particularly during device unregistration or specific error-handling scenarios in device registration (GitHub Advisory, Feedly). Lateral movement or data exfiltration are not associated with this vulnerability.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (4th percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). Exploitation is constrained to local attackers with low-privilege access who can trigger device unregistration or registration error paths.

Apply the upstream kernel patches that replace the to_linedisp() attachment-list lookup with container_of() in linedisp_release(). Patched commits are available at 625fdac41cfc4ca9e1774a0d31d7985aec2c1d66 and 7f138de156b20d9f9da6f72f90b63c01941d97d3 in the stable kernel tree (GitHub Advisory). Users running Linux kernel 6.19.x should upgrade to 6.19.12 or later; users on 7.0 release candidates should update to the patched 7.0 release. Linux distribution vendors (e.g., Red Hat) are tracking this via their own advisory processes (Red Hat Bugzilla). If immediate patching is not possible, systems that do not use auxdisplay line-display hardware can unload or blacklist the relevant kernel module as a temporary mitigation.