{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31481", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.100Z", "datePublished": "2026-04-22T13:54:08.236Z", "dateUpdated": "2026-04-22T13:54:08.236Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-22T13:54:08.236Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_trigger.c"], "versions": [{"version": "61d445af0a7c70018111919e47beaaee15653f2f", "lessThan": "771624b7884a83bb9f922ae64ee41a5f8b7576c9", "status": "affected", "versionType": "git"}, {"version": "61d445af0a7c70018111919e47beaaee15653f2f", "lessThan": "250ab25391edeeab8462b68be42e4904506c409c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_trigger.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9"}, {"url": "https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"}], "title": "tracing: Drain deferred trigger frees if kthread creation fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either."}], "id": "CVE-2026-31481", "lastModified": "2026-04-22T14:16:45.340", "metrics": {}, "published": "2026-04-22T14:16:45.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T18:53:13.756683+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that contains the tracing fix.", "If an immediate kernel upgrade is not possible, remove or avoid using the second traceon trigger that is known to fail, ensuring only successful triggers are enabled on the command line.", "Reboot the system after making the changes to enforce the updated kernel or modified boot settings."], "summary": {"action": "Apply patch", "impact": "Kernel crash via NULL pointer dereference"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all Linux kernel builds that contain the old tracing implementation prior to the applied patch. All current kernel releases that have not incorporated the fix remain susceptible; the exact affected kernel versions are not enumerated in the data.", "description_and_impact": "In the Linux kernel, a bug in the tracing subsystem allows faulty boot\u2011time trigger registration to leak memory and trigger a NULL pointer dereference, causing an immediate kernel crash. The flaw manifests when a second traceon trigger fails to start its cleanup kthread before the deferred trigger list is drained, leaving orphaned entries that are freed later as a null pointer. The resulting crash disrupts system availability and can be triggered through a modified kernel boot command line.", "risk_and_exploitability": "No CVSS or EPSS score is reported, and the flaw is not included in the CISA KEV catalog, indicating limited public exploitation data. The exploit requires precise control of the kernel boot command line, so it is effectively a local attack that only succeeds if the attacker can modify boot parameters or influence a compromised machine\u2019s bootloader. The lack of a public exploit suggests a low exploitation probability, but the impact of a kernel crash is severe and warrants remediation."}}}}, "created": "2026-04-22T19:00:08.094374+00:00", "updated": "2026-04-22T19:00:08.094387+00:00", "vendors": [], "weaknesses": ["CWE-476"]}