{"id":"CVE-2026-31481","state":"PUBLISHED","title":"tracing: Drain deferred trigger frees if kthread creation fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n  trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either.","publishedAt":"2026-04-22T13:54:08.236Z","updatedAt":"2026-05-11T22:09:34.083Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"771624b7884a83bb9f922ae64ee41a5f8b7576c9","versionType":"git"},{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"250ab25391edeeab8462b68be42e4904506c409c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_trigger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_trigger.c"]}],"references":["https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9","https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31481.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31481","state":"PUBLISHED","datePublished":"2026-04-22T13:54:08.236Z","dateUpdated":"2026-05-11T22:09:34.083Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.100Z"},"containers":{"cna":{"title":"tracing: Drain deferred trigger frees if kthread creation fails","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n  trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"771624b7884a83bb9f922ae64ee41a5f8b7576c9","versionType":"git"},{"version":"61d445af0a7c70018111919e47beaaee15653f2f","status":"affected","lessThan":"250ab25391edeeab8462b68be42e4904506c409c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_trigger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_trigger.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9"},{"url":"https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T22:09:34.083Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}