Skip to main content

Linux Kernel CVE-2026-31763

| EUVDEUVD-2026-26576 MEDIUM
2026-05-01 Linux
Red Hat Suse Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
May 08, 2026 - 20:33 vuln.today
CVSS changed
May 08, 2026 - 18:07 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26576
CVE Published
May 01, 2026 - 14:14 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:14 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iio: gyro: mpu3050: Fix incorrect free_irq() variable

The handler for the IRQ part of this driver is mpu3050->trig but, in the teardown free_irq() is called with handler mpu3050.

Use correct IRQ handler when calling free_irq().

AnalysisAI

Denial of service in the Linux kernel's mpu3050 gyroscope driver allows local authenticated attackers to crash the system via incorrect IRQ handler cleanup during module unload. A mismatch between the registered IRQ handler (mpu3050->trig) and the handler passed to free_irq() (mpu3050) causes improper cleanup, leading to resource leaks and potential kernel panic when the device is removed or the driver is unloaded. No public exploit code identified; patch available across affected kernel series.

Technical ContextAI

The mpu3050 driver is an Industrial I/O (IIO) subsystem driver for the InvenSense MPU-3050 three-axis gyroscope sensor integrated circuit. The vulnerability exists in the driver's IRQ management code, which handles interrupt delivery from the sensor hardware. The driver registers an interrupt handler using request_irq() with a specific handler function pointer (mpu3050->trig), but during teardown in the remove() or module unload path, free_irq() is called with an incorrect handler variable (mpu3050 instead of mpu3050->trig). This type error prevents the kernel's IRQ subsystem from properly deregistering and cleaning up the interrupt handler, leaving kernel resources in an inconsistent state. The root cause is a logical error in variable reference rather than a cryptographic, memory corruption, or protocol flaw - essentially a cleanup code bug.

RemediationAI

Vendor-released patches are available across all affected stable kernel series. Update to patched versions: Linux 5.10.253 or later for 5.10.x series, Linux 5.15.203 or later for 5.15.x series, Linux 6.1.168 or later for 6.1.x series, Linux 6.6.134 or later for 6.6.x series, Linux 6.12.81 or later for 6.12.x series, Linux 6.18.22 or later for 6.18.x series, or Linux 6.19.12 or later for 6.19.x series. Distribution kernel maintainers have released patched packages through their normal update channels. The fix involves correcting the free_irq() call in the mpu3050 driver's removal routine to use the correct handler variable (mpu3050->trig instead of mpu3050). For systems where immediate kernel upgrade is not feasible and the MPU-3050 sensor is not actively used, disable or unload the mpu3050 driver module to avoid the unload-time crash; however, this eliminates sensor functionality and is only a temporary workaround. See git.kernel.org stable branch commits for precise patch details and backport status across distributions.

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31763 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy