Skip to main content

Linux Kernel CVE-2026-31565

| EUVDEUVD-2026-25458 MEDIUM
Improper Locking (CWE-667)
2026-04-24 Linux GHSA-hp4x-9rgh-5pgm
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local trigger requiring CAP_NET_ADMIN for reset; pure availability impact via deadlock; no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:09 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:31 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25458
CVE Published
Apr 24, 2026 - 14:35 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix deadlock during netdev reset with active connections

Resolve deadlock that occurs when user executes netdev reset while RDMA applications (e.g., rping) are active. The netdev reset causes ice driver to remove irdma auxiliary driver, triggering device_delete and subsequent client removal. During client removal, uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, creating circular dependency and indefinite wait in iWARP mode. Skip QP reference count wait during device reset to prevent deadlock.

AnalysisAI

Deadlock in the Linux kernel's RDMA/irdma subsystem (CVE-2026-31565) causes an indefinite system hang when a netdev reset is performed on Intel ice Ethernet hardware while active RDMA/iWARP applications hold Queue Pair connections. The ice driver's removal of the irdma auxiliary driver triggers a circular dependency: uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference in iWARP mode, neither releasing first. No public exploit has been identified at time of analysis; an EPSS of 0.02% (7th percentile) and absence of CISA KEV listing confirm this is currently a low exploitation-priority issue concentrated in HPC and data center environments with Intel RDMA hardware.

Technical ContextAI

The irdma driver implements iWARP (Internet Wide Area RDMA Protocol) support for Intel Ethernet adapters managed by the ice driver. RDMA Queue Pairs (QPs) are the fundamental communication endpoints in the RDMA programming model; reference counting governs their lifecycle. The root cause (CWE-667: Improper Locking) is a classic deadlock: during device teardown initiated by a netdev reset, the RDMA verbs layer (uverbs_client) blocks waiting for all QP references to drop to zero, but the Connection Manager Abstraction layer (cma_client) holds the last outstanding reference and cannot release it because the teardown sequence has already progressed past the point where normal reference release is possible. This circular wait is specific to iWARP mode. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirms the flaw spans multiple Linux kernel stable branches. The fix skips the QP reference count wait during device reset, breaking the circular dependency without affecting normal shutdown paths.

RemediationAI

The primary fix is upgrading the Linux kernel to the appropriate patched stable release for your branch: 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0. Upstream fix commits are published at git.kernel.org/stable (see reference links for each branch). Ubuntu users should apply the update from USN-8567-1 at https://ubuntu.com/security/notices/USN-8567-1. Siemens product users should follow guidance in SSA-019113 and SSA-082556. If immediate patching is not feasible, the most effective compensating control is to operationally quiesce all active RDMA/iWARP connections (terminate rping and equivalent workloads) before performing any netdev reset on affected Intel ice/irdma interfaces - this prevents the circular wait from forming. Trade-off: this requires coordination between network administrators and RDMA application owners, which may be impractical or disruptive in automated HPC environments. Alternatively, scheduling maintenance windows so that netdev resets occur only when no RDMA sessions are active provides equivalent protection. Disabling the irdma module entirely prevents the deadlock but eliminates all RDMA functionality.

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31565 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy