What’s Vulnerable › Vulnerabilities

CVE-2026-31559: LoongArch: Fix missing NULL checks for kstrdup()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing NULL checks for kstrdup() 1. Replace "of_find_node_by_path("/")" with "of_root" to avoid multiple calls to "of_node_put()". 2. Fix a potential kernel oops during early boot when memory allocation fails while parsing CPU model from device tree.

Affected products

• Linux kernel: from 6.12.43 before 6.12.80; from 6.15.11 before 6.16; from 6.16.2 before 6.17; from 6.17.1 before 6.18.21; from 6.19 before 6.19.11; 6.17, 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5 (+2) — fixed in 6.12.80, 6.16, 6.17, 6.18.21, 6.19.11

How to fix

Upgrade to a fixed version: Linux kernel 6.12.80, 6.16, 6.17, 6.18.21. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3a28daa9b7d7c2ddf2c722e9e95d7e0928bf0cd1
• https://git.kernel.org/stable/c/5e7fde2c551f86e6c3de3fd7a9b1f52806ac8db0
• https://git.kernel.org/stable/c/a1da957c25cf751a2dce8fb7777f82ccbac0cb3e
• https://git.kernel.org/stable/c/b61a309743322fb57fb9afa9aa3495ac758e4f5e

Get alerted when CVE-2026-31559 or the next vulnerability affects your stack