CVE-2026-31744: PM: EM: Fix NULL pointer dereference when perf domain ID is not found
In the Linux kernel, the following vulnerability has been resolved:
PM: EM: Fix NULL pointer dereference when perf domain ID is not found
devenergymodelnlgetperfdomainsdoit() calls emperfdomaingetbyid() but does not check the return value before passing it to emnlgetpdsize(). When a caller supplies a non-existent perf domain ID, emperfdomaingetbyid() returns NULL, and emnlgetpdsize() immediately dereferences pd->cpus (struct offset 0x30), causing a NULL pointer dereference.
The sister handler devenergymodelnlgetperftabledoit() already handles this correctly via emnlgetpdtableid(), which returns NULL and causes the caller to return -EINVAL. Add the same NULL check in the get-perf-domains do handler.
[ rjw: Subject and changelog edits ]
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can realistically trigger the issue?
Systems are exposed when a local, low-privileged user can invoke the energy-model netlink get-perf-domains handler and supply a performance-domain ID that does not exist. The described impact is a NULL pointer dereference resulting in a denial of service.
What does an attacker need to do to trigger the crash?
Exploitation requires local access, low privileges, and no user interaction. The attacker supplies a non-existent performance-domain ID, causing the lookup to return NULL before the vulnerable handler dereferences it.
What behavior changes after applying the patch?
The fix adds a NULL check to the get-perf-domains handler so that an unknown performance-domain ID is rejected with -EINVAL rather than dereferenced. Apply an available patch from the referenced stable kernel commits.