CVE-2026-31480
Received Received - Intake
Deadlock Vulnerability in Linux Kernel CPU Hotplug Tracing

Publication date: 2026-04-22

Last updated on: 2026-04-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential deadlock in cpu hotplug with osnoise The following sequence may leads deadlock in cpu hotplug: task1 task2 task3 ----- ----- ----- mutex_lock(&interface_lock) [CPU GOING OFFLINE] cpus_write_lock(); osnoise_cpu_die(); kthread_stop(task3); wait_for_completion(); osnoise_sleep(); mutex_lock(&interface_lock); cpus_read_lock(); [DEAD LOCK] Fix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-22
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31480
EUVD
EUVD-2026-24839
Affected Vendors & Products
Showing 14 associated CPEs
Vendor Product Version / Range
linux linux_kernel 5.14
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 5.14.1 (inc) to 5.15.203 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.168 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.21 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.11 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.131 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.80 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a potential deadlock issue in the Linux kernel related to CPU hotplug operations involving the osnoise component.

The deadlock occurs due to an improper locking sequence between mutex_lock(&interface_lock) and cpus_read_lock() during CPU offline events, where multiple tasks try to acquire locks in conflicting orders, causing the system to hang.

The fix involves swapping the order of cpus_read_lock() and mutex_lock(&interface_lock) to prevent the deadlock.

Impact Analysis

This vulnerability can cause the Linux kernel to deadlock during CPU hotplug operations, which means the system could hang or become unresponsive when CPUs are taken offline.

Such deadlocks can lead to system instability, degraded performance, or require a reboot to recover, impacting availability.

Mitigation Strategies

The vulnerability is fixed by swapping the order of cpus_read_lock() and mutex_lock(&interface_lock) in the Linux kernel code to prevent a potential deadlock during CPU hotplug operations involving osnoise.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31480. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart