Skip to main content

Linux Kernel CVE-2026-31486

| EUVDEUVD-2026-24852 HIGH
Improper Locking (CWE-667)
2026-04-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
High
Disputed · 7.1 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local authenticated access to PMBus regulator interfaces (AV:L/PR:L), winning a timing race raises complexity (AC:H), yielding state corruption and instability (I:H/A:H) with no data leak (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 05:15 vuln.today
Patch released
Apr 28, 2026 - 13:06 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.1 (HIGH)
Patch available
Apr 22, 2026 - 16:33 EUVD
EUVD ID Assigned
Apr 22, 2026 - 14:22 euvd
EUVD-2026-24852
CVE Published
Apr 22, 2026 - 14:16 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/core) Protect regulator operations with mutex

The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions.

However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex.

Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker.

Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset().

While at it, remove the unnecessary include of linux/of.h.

AnalysisAI

Improper locking in the Linux kernel's PMBus hardware monitoring core (drivers/hwmon/pmbus) allows a local low-privileged attacker to trigger a race condition against unserialized regulator voltage operations, corrupting shared PMBus register state and per-page data. The pmbus_regulator_get_voltage(), set_voltage(), and list_voltage() paths accessed shared data without holding update_lock, and the fix reworks notification delivery through a worker to avoid a mutex deadlock. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), consistent with a hardware-dependent local integrity/availability issue rather than a broadly exploitable flaw.

Technical ContextAI

The affected component is the PMBus (Power Management Bus) subsystem within the Linux kernel hwmon (hardware monitoring) framework, specifically drivers/hwmon/pmbus/pmbus_core.c. PMBus is an SMBus/I2C-based protocol for digitally managed power supplies, VRMs, and regulators, and the kernel exposes these devices through the regulator API. The root cause is CWE-667 (Improper Locking): the regulator callbacks read and write shared driver state and hardware registers without holding the driver's update_lock mutex. A naive fix - simply taking the mutex inside those callbacks - would deadlock because pmbus_regulator_notify() calls regulator_notifier_call_chain() while the mutex is already held (e.g., from pmbus_fault_handler()), and a notified regulator consumer that calls back into a now-locked voltage function would re-acquire the same non-recursive mutex. The remediation restructures notification into a per-page atomic bitmask processed by a deferred worker so notifications are delivered outside the lock. The CPE set names only linux:linux_kernel with the mainline fix landing around 7.0-rc and stable backports.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - the backported fix lands in the 6.18.21 and 6.19.11 stable series (and the mainline 7.0 line), applied via the referenced git.kernel.org commits (e.g., 2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07, 4e9d723d9f198b86f6882a84c501ba1f39e8d055, 754bd2b4a084b90b5e7b630e1f423061a9b9b761). Consume the fix through your distribution's kernel update rather than cherry-picking where possible, and reboot to activate the new kernel. Verify the fix commits at https://git.kernel.org/stable/c/2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07 and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31486. If immediate patching is not feasible, the practical compensating control is to reduce local attack surface around the sysfs regulator/hwmon interface: on systems that do not require PMBus power management, avoid loading the pmbus/pmbus_core modules (blacklist them), which eliminates the vulnerable code path entirely but disables monitoring/control of any PMBus-managed regulators; where the driver is needed, restrict local access and tighten permissions on the corresponding hwmon/regulator sysfs nodes so untrusted local users cannot repeatedly drive voltage operations, at the cost of reduced observability for non-privileged monitoring tooling.

Same weakness CWE-667 – Improper Locking

View all
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5
CVE-2026-53049 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31486 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy