CVE-2026-31549

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

i2c: cp2615: fix serial string NULL-deref at probe

The cp2615 driver uses the USB device serial string as the i2c adapter name but does not make sure that the string exists.

Verify that the device has a serial number before accessing it to avoid triggering a NULL-pointer dereference (e.g. with malicious devices).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= 4a7695429eade517b07ea72f9ec366130e81a076, < e68c267787778bcdf3d91b06f794faaba7f0d1d1; >= 4a7695429eade517b07ea72f9ec366130e81a076, < 4a22af879172336370ae3e81e7f65fb2f69472ee; >= 4a7695429eade517b07ea72f9ec366130e81a076, < 69aece634a7eebafd9a596e5494d52facf6f26ec; >= 4a7695429eade517b07ea72f9ec366130e81a076, < 13ccf9b106bba121728f1625c4375a1bd8f5c5a3; >= 4a7695429eade517b07ea72f9ec366130e81a076, < a9778298f47036866ea15eeb17242e8a4612580f; >= 4a7695429eade517b07ea72f9ec366130e81a076, < efe996bcfe50c2dcc6cf65c574285713b722ced7; >= 4a7695429eade517b07ea72f9ec366130e81a076, < aa79f996eb41e95aed85a1bd7f56bcd6a3842008
LinuxLinux5.13

References

Timeline

Published
Apr 24, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-31553.1The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. TCVE-2026-315505.5In the Linux kernel, the following vulnerability has been resolved: pmdomain: bcm: bcm2835-power: Increase ASB control timeout The bcm2835CVE-2026-315515.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. syzCVE-2026-315527.5In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough CVE-2026-315538.8In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() Using "CVE-2026-315547.8In the Linux kernel, the following vulnerability has been resolved: futex: Require sys_futex_requeue() to have identical flags Nicholas reCVE-2026-315555.5In the Linux kernel, the following vulnerability has been resolved: futex: Clear stale exiting pointer in futex_lock_pi() retry path FuzzyCVE-2026-315565.5In the Linux kernel, the following vulnerability has been resolved: xfs: scrub: unlock dquot before early return in quota scrub xchk_quotaCVE-2026-315577.5In the Linux kernel, the following vulnerability has been resolved: nvmet: move async event work off nvmet-wq For target nvmet_ctrl_free()CVE-2026-315588.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust kvm_get_vcpu_CVE-2026-315595.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing NULL checks for kstrdup() 1. Replace "of_find_nCVE-2026-315605.5In the Linux kernel, the following vulnerability has been resolved: spi: spi-dw-dma: fix print error log when wait finish transaction If a
CVE-2026-31549: Medium severity, CVSS 5.5 | Vulnix