Linux Kernel CVE-2026-31567

The Linux kernel's power management sleep subsystem manages GFP (Get Free Pages) memory allocation flags during suspend/hibernate cycles via pm_restrict_gfp_mask() and pm_restore_gfp_mask(). Commit 35e4a69b2003f introduced refcount-based stacking of GFP mask restrictions (saved_gfp_count), adding a WARN_ON() guard when pm_restore_gfp_mask() is called with the counter already at zero. The uswsusp (userspace software suspend) hibernation interface legitimately calls pm_restore_gfp_mask() defensively in three code paths - SNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, and snapshot_release() - where the GFP mask may or may not be restricted depending on execution flow. These defensive calls were silent no-ops before the stacking commit but now reachably trigger the assertion, classifying this as CWE-617 (Reachable Assertion). On kernels configured with panic_on_warn=1 (common in hardened or production environments), the WARN_ON() escalates to a kernel panic. Additionally, kernel warning output can expose stack traces and internal addresses, which partially explains the 'Information Disclosure' tag - though NVD's CVSS scores this as C:N, treating the address leak as non-exploitable in isolation. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.