CVE-2026-31482

Vulnerability

CVE-2026-31482 is a missing register clearing vulnerability in the Linux kernel's s390 architecture. Before commit f33f2d4c7c80 ("s390, all kernel entry handlers loaded the r12 register with the current task pointer (via lg %r12,__LC_CURRENT) for use by branch prediction macros (BPENTER/BPEXIT). That commit removed the TIF_ISOLATE_BP feature, dropping both the branch prediction macros and the r12 load, but did not add r12 to the register clearing sequence. This oversight means that on kernel entry, r12 may retain stale data from the previous execution context, potentially leaking sensitive information.

Exploitation

Exploitation

An attacker with local access and the ability to observe or influence kernel entry points could potentially exploit this information leak. The vulnerability is present in all s390 kernel entry paths that were previously loading r12 but no longer clear it. No special privileges are required beyond local access, as the leak occurs during normal kernel entry operations.

Impact

The primary impact is information disclosure. The r12 register may contain kernel pointers or other sensitive data from the previous context, which could be observed by an attacker. This could aid in bypassing kernel address space layout randomization (KASLR) or other security mechanisms. The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and potential for information disclosure.

Mitigation

The fix adds xgr %r12,%r12 to the register clearing sequence, ensuring r12 is zeroed on every kernel entry. The patch has been applied to the stable kernel tree [1][2][3][4]. Users should update to a kernel version containing this commit to mitigate the vulnerability.