CVE-2026-31481

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Drain deferred trigger frees if kthread creation fails

Boot-time trigger registration can fail before the trigger-data cleanup

kthread exists. Deferring those frees until late init is fine, but the

post-boot fallback must still drain the deferred list if kthread

creation never succeeds.

Otherwise, boot-deferred nodes can accumulate on

trigger_data_free_list, later frees fall back to synchronously freeing

only the current object, and the older queued entries are leaked

forever.

To trigger this, add the following to the kernel command line:

trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon

The second traceon trigger will fail and be freed. This triggers a NULL

pointer dereference and crashes the kernel.

Keep the deferred boot-time behavior, but when kthread creation fails,

drain the whole queued list synchronously. Do the same in the late-init

drain path so queued entries

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References