CVE-2026-31646 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() page_pool_create() can return an ERR_PTR on failure. The return value is used unconditionally in the loop that follows, passing the error pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(), which dereferences it, causing a kernel oops. Add an IS_ERR check after page_pool_create() to return early on failure.
A vulnerability exists in the Linux kernel's LAN966X Ethernet driver, specifically in the function responsible for allocating pages from the page pool for receive operations. The issue arises because the page_pool_create() function can return an error pointer on failure, but this potential error is not checked before the pointer is used. This oversight allows a null pointer to be dereferenced, leading to a kernel oops, which is a type of crash in the Linux kernel. The vulnerability affects the stable versions of the Linux kernel that include the LAN966X driver.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The official Linux kernel Git repository can be checked out for the latest stable releases.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/305832c53551cfbe6e5b81ca7ee765e60f4fe8e9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3fd0da4fd8851a7e62d009b7db6c4a05b092bc19 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7caf90d9ab97951a58d1de85ab7e7d7cca7a4513 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b5dcb41ba891b55157006cac79825c78a32b409e | kernel.org | Patch |
| https://git.kernel.org/stable/c/e63265f188ea39dcf5f546770650027528f3bd0f | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.2.1, < 6.6.135 >= 6.7, < 6.12.82 >= 6.13, < 6.18.23 >= 6.19, < 6.19.13 6.2 - 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 7.0 rc7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | New CVE Received | kernel.org |