Linux Kernel CVE-2026-31587

Requires local authenticated access with low-privilege user account (PR:L) on systems running vulnerable Linux kernel versions with Qualcomm q6apm audio driver loaded (snd_q6apm.ko module present). Exploitation specifically requires triggering device unbind operations on the q6apm-dai platform driver, which occurs during: Protection Domain Restart (PDR) events on Qualcomm platforms when audio DSP crashes or restarts, manual driver unbind via sysfs (/sys/bus/platform/drivers/q6apm-dai/unbind) if user has write access, or system suspend/resume cycles that unload and reload audio drivers. Vulnerable code path only executes when ASoC topology has been loaded with dynamically registered DAIs, which is the default configuration on Snapdragon X Elite devices. User interaction is not required (UI:N) once conditions are met. Attack is limited to specific hardware platforms using Qualcomm Hexagon DSP audio subsystem - not exploitable on x86 systems or ARM devices using different audio drivers. Exploitation window is narrow (milliseconds during driver cleanup) but deterministic with KASAN disabled in production kernels. No special kernel configuration or non-default settings required beyond presence of Qualcomm audio hardware and drivers.

Real-world risk is moderate despite CVSS 7.8 high severity rating. The vulnerability requires local authenticated access (AV:L/PR:L) with low attack complexity (AC:L), limiting exposure to scenarios where an attacker already has user-level shell access on affected systems. EPSS probability of 0.02% (5th percentile) correctly reflects the narrow attack surface - this is not remotely exploitable and requires physical or prior compromise. No CISA KEV listing indicates no confirmed active exploitation campaigns. The vulnerability triggers during device unbind operations (typically hardware hotplug, driver reload, or Protection Domain Restart events on Qualcomm platforms), not during normal runtime, further constraining practical exploitation windows. Impact is high if triggered (arbitrary kernel code execution leading to privilege escalation, DoS via kernel panic, or information disclosure via KASAN reports), but exploitation requires precise timing to catch the narrow use-after-free window during driver cleanup. Primary risk is to multi-user systems or containerized environments where local authenticated users might attempt privilege escalation. CVSS severity aligns with impact potential, but EPSS correctly downgrades urgency given exploitation prerequisites. Patches available across all active kernel branches (6.12.x through 7.0.x) indicate vendor responsiveness, reducing residual risk for patched systems.

An authenticated local user on a Lenovo ThinkPad running vulnerable kernel versions gains shell access via compromised web service or stolen credentials. Attacker monitors kernel logs to identify Qualcomm audio driver device paths, then triggers Protection Domain Restart event or manually unbinds the q6apm driver via /sys/bus/platform/drivers/q6apm-dai/unbind while simultaneously allocating spray objects to occupy freed DAI structure memory. By timing memory allocation to overwrite freed DAI pointers with crafted data before component cleanup accesses them, attacker achieves controlled kernel memory corruption. This enables arbitrary code execution in kernel context, escalating from low-privileged user to root and bypassing all userspace security controls. Attack complexity is low per CVSS vector but requires local access and precise timing of unbind operations.