The vulnerability (CVE-2026-31689) in the Linux kernel EDAC/mc subsystem arises from improper error path ordering in the edac_mc_alloc() function. Specifically, if the allocation of mci->pvt_info fails, the error path calls put_device(), which triggers the device's release function. However, device_initialize() is called only after this failure, meaning the device and its release function pointer are uninitialized when invoked. This leads to kernel warnings and potential instability. The issue is resolved by correcting the initialization order to ensure device_initialize() is called before put_device() in error scenarios. This fix is included in Linux kernel versions 6.8.0 and later. The vulnerability has a CVSS 3.1 base score of 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability causes kernel warnings and may lead to system instability or crashes due to calling uninitialized device release function pointers during error handling. It does not affect confidentiality or integrity but impacts system availability. There are no known exploits in the wild. The CVSS score of 5.5 reflects a medium severity impact primarily on availability.

A patch is available and included in Linux kernel versions 6.8.0 and later. Users should update their Linux kernel to a fixed version equal to or greater than 6.8.0-1064.72~22.04.1 (and related builds) and reboot the system to apply the fix. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating and rebuilding kernel modules as needed.