Linux Kernel CVE-2026-31523

The vulnerability resides in the nvme-pci driver's queue polling mechanism within the Linux kernel's NVMe subsystem. NVMe supports two completion processing modes: interrupt-driven (legacy) and polled (high-priority, lower-latency). The vulnerability is triggered during kernel reset operations when the polled queue count can be dynamically modified via sysfs at runtime. A race condition (CWE-367: Improper Synchronization) occurs in the brief window before the block layer's queue maps reflect the configuration change. A high-priority I/O (hipri) task attempting to poll a queue during this window may race with an interrupt-driven completion handler on the same queue, resulting in double completion events where a single I/O request is completed twice-once via polling and once via interrupt handler-corrupting request tracking and causing potential data loss or system instability.