Skip to main content

Linux Kernel EUVDEUVD-2026-25540

| CVE-2026-31647 MEDIUM
2026-04-24 Linux GHSA-5fx9-vhx9-34xx
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to trigger NIC driver async path; PREEMPT_RT dependency raises practical complexity but not CVSS AC; no confidentiality or integrity impact, only availability via kernel crash.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:48 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:18 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25540
CVE Published
Apr 24, 2026 - 14:45 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling

Switch from using the completion's raw spinlock to a local lock in the idpf_vc_xn struct. The conversion is safe because complete/_all() are called outside the lock and there is no reason to share the completion lock in the current logic. This avoids invalid wait context reported by the kernel due to the async handler taking BH spinlock:

[ 805.726977] ========= [ 805.726991] [ BUG: Invalid wait context ] [ 805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S OE [ 805.727026] ----------------------------- [ 805.727038] kworker/u261:0/572 is trying to lock: [ 805.727051] ff190da6a8dbb6a0 (&vport_config->mac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727099] other info that might help us debug this: [ 805.727111] context-{5:5} [ 805.727119] 3 locks held by kworker/u261:0/572: [ 805.727132] #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730 [ 805.727163] #1: ff3c6f0a6131fe50 ((work_completion)(&(&adapter->mbx_task)->work)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730 [ 805.727191] #2: ff190da765190020 (&x->wait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf] [ 805.727218] stack backtrace: ... [ 805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf] [ 805.727247] Call Trace: [ 805.727249] <TASK> [ 805.727251] dump_stack_lvl+0x77/0xb0 [ 805.727259] __lock_acquire+0xb3b/0x2290 [ 805.727268] ? __irq_work_queue_local+0x59/0x130 [ 805.727275] lock_acquire+0xc6/0x2f0 [ 805.727277] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727284] ? _printk+0x5b/0x80 [ 805.727290] _raw_spin_lock_bh+0x38/0x50 [ 805.727298] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727303] idpf_mac_filter_async_handler+0xe9/0x260 [idpf] [ 805.727310] idpf_recv_mb_msg+0x1c8/0x710 [idpf] [ 805.727317] process_one_work+0x226/0x730 [ 805.727322] worker_thread+0x19e/0x340 [ 805.727325] ? __pfx_worker_thread+0x10/0x10 [ 805.727328] kthread+0xf4/0x130 [ 805.727333] ? __pfx_kthread+0x10/0x10 [ 805.727336] ret_from_fork+0x32c/0x410 [ 805.727345] ? __pfx_kthread+0x10/0x10 [ 805.727347] ret_from_fork_asm+0x1a/0x30 [ 805.727354] </TASK>

AnalysisAI

Denial of service via kernel panic in the Linux kernel idpf NIC driver arises from invalid spinlock nesting in the async virtchannel message handler, most critically on PREEMPT_RT-enabled kernels. The idpf_mac_filter_async_handler acquires a BH spinlock while the workqueue thread already holds the raw spinlock embedded in the completion primitive of idpf_vc_xn, violating PREEMPT_RT lock context rules and triggering a kernel BUG that crashes the system. No public exploit identified at time of analysis; EPSS is 0.02%, indicating negligible observed exploitation interest for this narrow driver-level locking defect.

Technical ContextAI

The vulnerable component is the idpf (Intel Infrastructure Data Path Function) NIC driver in the Linux kernel; no CWE was assigned, but the root cause is a synchronization/locking error. Under PREEMPT_RT, the kernel converts most spinlocks to sleeping mutexes and enforces strict lock ordering: a thread holding a raw spinlock must not acquire a BH spinlock, because BH locks carry a different wait context class (context-{5:5} vs {2:2} and {3:3} shown in the backtrace). The idpf_vc_xn struct used the completion primitive's raw spinlock; when the idpf-mbx workqueue (idpf_mbx_task) ran idpf_recv_mb_msg holding that raw spinlock and dispatched the async handler idpf_mac_filter_async_handler, that handler called _raw_spin_lock_bh on mac_filter_list_lock, crossing the forbidden raw→BH nesting boundary. The kernel's lockdep validator raises 'BUG: Invalid wait context', typically producing a panic. The fix replaces the raw spinlock in idpf_vc_xn with a local_lock, which is safe because complete/_all() are already called outside the lock boundary. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel release: Linux 7.0, 6.19.13, 6.18.23, or 6.12.83, selecting the branch that matches the deployed kernel series. Upstream fix commits are available for cherry-pick or review at https://git.kernel.org/stable/c/b448529f2f2921c6fe82fd4e985cc7c05cbf02a3, https://git.kernel.org/stable/c/e02c974fc331f04b5ba2007d4bc6862df8a43148, https://git.kernel.org/stable/c/3bb632c6b6d8154e9019beda4a43a4b518ee3e8a, and https://git.kernel.org/stable/c/591478118293c1bd628de330a99eb1eb2ef8d76b. Where immediate patching is not feasible, unloading the idpf kernel module (rmmod idpf) eliminates the vulnerable code path entirely, at the cost of losing connectivity on Intel idpf-class network adapters - evaluate network redundancy before applying this control. Disabling PREEMPT_RT or lockdep in the kernel build configuration prevents the BUG from firing but does not remove the underlying race; this trade-off is unacceptable in real-time deployments where PREEMPT_RT is a hard requirement. No vendor security advisories from Red Hat or SUSE were provided in the reference data; check distribution errata channels for distribution-specific patch availability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25540 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy