Skip to main content

Linux Kernel CVE-2026-31545

| EUVDEUVD-2026-25438 MEDIUM
2026-04-24 Linux GHSA-3ffm-mmhr-cmvg
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H assessed (vs NVD AC:L) because triggering requires specific non-default hardware: NXP NCI GPIOs routed through I2C expanders, not a general-purpose configuration.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:16 vuln.today
CVSS changed
Apr 28, 2026 - 21:08 NVD
5.5 (MEDIUM)
Patch released
Apr 28, 2026 - 20:53 nvd
Patch available
Patch available
Apr 24, 2026 - 16:01 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25438
CVE Published
Apr 24, 2026 - 14:33 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFC: nxp-nci: allow GPIOs to sleep

Allow the firmware and enable GPIOs to sleep.

This fixes a `WARN_ON' and allows the driver to operate GPIOs which are connected to I2C GPIO expanders.

-- >8 -- kernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98 -- >8 --

AnalysisAI

The NXP-NCI NFC driver in the Linux kernel triggers a kernel WARN_ON and fails to operate correctly when firmware and enable GPIOs are routed through I2C GPIO expanders, causing denial of service to NFC subsystem functionality on affected hardware. Systems running kernel versions from 5.4 through pre-patch releases across multiple stable branches are affected when using NXP NCI NFC chipsets with I2C-connected GPIO expanders. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit code identified at time of analysis, this is a low-risk operational reliability defect relevant primarily to embedded and IoT deployments.

Technical ContextAI

The vulnerability resides in the nxp-nci driver within the Linux kernel NFC subsystem. The root cause is incorrect use of gpiod_set_value() instead of gpiod_set_value_cansleep() for controlling firmware and enable GPIO pins. I2C GPIO expanders - discrete chips that extend a SoC's GPIO count over an I2C bus - require the sleeping variant because I2C transactions can block the calling thread. Invoking the non-sleeping gpiod_set_value() in an I2C-backed GPIO context violates kernel locking assumptions and triggers a WARN_ON assertion at drivers/gpio/gpiolib.c:3880. The fix allows sleep in these GPIO paths, both resolving the kernel warning and enabling proper operation with I2C expander hardware. CWE classification is not formally assigned, but this is most closely a driver API misuse / missing sleep-safe synchronization defect. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across the impacted stable branches.

RemediationAI

Upgrade to a patched stable kernel version: 5.10.253 or later, 5.15.203 or later, 6.1.167 or later, 6.6.130 or later, 6.12.78 or later, 6.18.20 or later, 6.19.10 or later, or kernel 7.0 or later. Patch commits are available in the Linux stable tree at git.kernel.org (see references: 0c2320c3c860, 2a175bc3c338, c24dcac1a9d1, 70662874f646, 548a1bfe5913, 4de9ed2ea22d, 783f05e560d7, 55dc632ab2ac). Ubuntu users should apply USN-8567-1 via standard package management. For systems where kernel patching cannot be immediately performed, the practical hardware-level workaround is to avoid routing NXP NCI NFC firmware and enable GPIO pins through I2C GPIO expanders - using direct SoC GPIO connections eliminates the sleep-constraint conflict entirely, though this is typically not feasible on fixed PCB designs. The WARN_ON does not halt the kernel, so continued operation while scheduling a maintenance window for patching is viable.

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31545 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy