CVE-2026-31480
Deadlock Vulnerability in Linux Kernel CPU Hotplug Tracing
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.14 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.14.1 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.131 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a potential deadlock issue in the Linux kernel related to CPU hotplug operations involving the osnoise component.
The deadlock occurs due to an improper locking sequence between mutex_lock(&interface_lock) and cpus_read_lock() during CPU offline events, where multiple tasks try to acquire locks in conflicting orders, causing the system to hang.
The fix involves swapping the order of cpus_read_lock() and mutex_lock(&interface_lock) to prevent the deadlock.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to deadlock during CPU hotplug operations, which means the system could hang or become unresponsive when CPUs are taken offline.
Such deadlocks can lead to system instability, degraded performance, or require a reboot to recover, impacting availability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by swapping the order of cpus_read_lock() and mutex_lock(&interface_lock) in the Linux kernel code to prevent a potential deadlock during CPU hotplug operations involving osnoise.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.