PT-2026-34929 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31577

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the nilfs2 component within the nilfs mdt save to shadow map() function. The btree node cache i assoc inode of the DAT inode is initialized lazily during btree operations. However, the nilfs mdt save to shadow map() function assumes this variable is already initialized when copying dirty pages to the shadow map during garbage collection. If the NILFS IOCTL CLEAN SEGMENTS command is called immediately after mounting and before any btree operation occurs on the DAT inode, i assoc inode remains NULL, resulting in a general protection fault.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-31577

ECHO-E665-D744-85DB

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 77

• https://git.kernel.org/stable/c/7318e3549518ce8f14776a489d86488d80d7e2c8 · Patch
• https://ubuntu.com/security/CVE-2026-31577 · Vendor Advisory
• https://git.kernel.org/stable/c/4a4e0328edd9e9755843787d28f16dd4165f8b48 · Patch
• https://git.kernel.org/stable/c/97fb7afec404912d967a7d4715f37742666b3084 · Patch
• https://git.kernel.org/stable/c/c36e206f302f1ddefed92d09ecbba070e1ae079e · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31577 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31577 · Security Note
• https://git.kernel.org/stable/c/449ec5fc99f45974525ba9eea16b6670c45cd363 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31577 · Vendor Advisory
• https://git.kernel.org/stable/c/41de342278ae025c99cc8d33648773f05e306cf1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31577 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31577 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31577 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31616 · Note