Skip to main content

Linux Kernel CVE-2026-31550

| EUVDEUVD-2026-25443 MEDIUM
2026-04-24 Linux GHSA-jccg-jh56-vh7j
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H reflects the race-condition timing requirement (concurrent V3D load and PM suspend on BCM2711-only hardware); no confidentiality or integrity impact exists.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:14 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:15 nvd
Patch available
Patch available
Apr 24, 2026 - 16:01 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25443
CVE Published
Apr 24, 2026 - 14:33 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: bcm: bcm2835-power: Increase ASB control timeout

The bcm2835_asb_control() function uses a tight polling loop to wait for the ASB bridge to acknowledge a request. During intensive workloads, this handshake intermittently fails for V3D's master ASB on BCM2711, resulting in "Failed to disable ASB master for v3d" errors during runtime PM suspend. As a consequence, the failed power-off leaves V3D in a broken state, leading to bus faults or system hangs on later accesses.

As the timeout is insufficient in some scenarios, increase the polling timeout from 1us to 5us, which is still negligible in the context of a power domain transition. Also, replace the open-coded ktime_get_ns()/ cpu_relax() polling loop with readl_poll_timeout_atomic().

AnalysisAI

Insufficient ASB polling timeout in the Linux kernel's bcm2835-power pmdomain driver intermittently fails to complete the V3D AXI Slave Bridge handshake on BCM2711 hardware during runtime PM suspend, leaving the VideoCore 3D GPU in a broken power state. Systems running intensive V3D workloads on BCM2711 (e.g., Raspberry Pi 4) may subsequently experience bus faults or full system hangs on later GPU accesses. No public exploit code exists and EPSS is 0.02% (7th percentile), consistent with a hardware-specific reliability defect rather than a broadly exploitable security attack; the vulnerability is not in CISA KEV.

Technical ContextAI

The affected code resides in drivers/pmdomain/bcm/bcm2835-power.c within the Linux kernel's power management domain subsystem. The BCM2711 SoC (Raspberry Pi 4) uses an AXI Slave Bridge (ASB) to gate power to hardware blocks including V3D (the VideoCore 3D GPU). The bcm2835_asb_control() function polls for bridge acknowledgment using a 1-microsecond timeout via an open-coded ktime_get_ns()/cpu_relax() loop - which proves insufficient under heavy computational load on BCM2711. The fix raises the timeout to 5us and replaces the manual loop with the kernel-provided readl_poll_timeout_atomic() helper. No CWE is formally assigned; the root cause is a hardware handshake race condition (closest to CWE-362 Concurrent Execution Using Shared Resource with Improper Synchronization). The CPE cpe:2.3:a:linux:linux:* covers the full kernel tree, but practical impact is strictly limited to BCM2711 targets. The EUVD 'Information Disclosure' tag does not match the CVE description and appears to be a metadata classification error - no disclosure mechanism is described.

RemediationAI

Apply the upstream stable kernel patch for your active series: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or 7.0, referenced via kernel.org stable commits including https://git.kernel.org/stable/c/622ab02e955c35c125ff2b65d8327b2c52db8758 and peer commits for each series. Ubuntu users should apply USN-8567-1 via standard package updates (https://ubuntu.com/security/notices/USN-8567-1); Red Hat and SUSE users should watch for distributor-backported advisories. If patching BCM2711 systems is not immediately feasible, disable runtime PM for the V3D device to prevent the failing suspend path from executing: write 'on' to the power/control sysfs attribute of the V3D platform device (echo on > /sys/bus/platform/devices/<v3d-device>/power/control). This workaround increases idle power consumption on the V3D block and is not suitable for battery-sensitive deployments, but eliminates the race condition.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31550 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy