CVE-2026-31753: auxdisplay: line-display: fix NULL dereference in linedisp_release
In the Linux kernel, the following vulnerability has been resolved:
auxdisplay: line-display: fix NULL dereference in linedisprelease
linedisprelease() currently retrieves the enclosing struct linedisp via tolinedisp(). That lookup depends on the attachment list, but the attachment may already have been removed before putdevice() invokes the release callback. This can happen in linedispunregister(), and can also be reached from some linedispregister() error paths.
In that case, tolinedisp() returns NULL and linedisprelease() dereferences it while freeing the display resources.
The struct device released here is the embedded linedisp->dev used by linedispregister(), so retrieve the enclosing object directly with containerof() instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1006.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31753?
The severity of CVE-2026-31753 is rated as medium with a CVSS score of 5.5.
What type of vulnerability is CVE-2026-31753?
CVE-2026-31753 is identified as a Null Pointer Dereference vulnerability in the Linux kernel.
How do I fix CVE-2026-31753?
To fix CVE-2026-31753, apply the available patch provided by The Linux Foundation.
Which software is affected by CVE-2026-31753?
CVE-2026-31753 affects the Linux kernel used in various distributions managed by The Linux Foundation.
When was CVE-2026-31753 published?
CVE-2026-31753 was published on May 1, 2026.