CVE-2026-31741
Runtime PM Counter Underflow in RZ MTU3 Counter
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's rz-mtu3 counter component. It occurs because the runtime power management (PM) counter can be toggled multiple times incorrectly when writing to the sysfs enable file.
If a user writes 0 multiple times to the sysfs enable file, the runtime PM usage count underflows, causing an error message and potentially accessing hardware registers with clocks turned off. Similarly, writing 1 multiple times increments the usage count each time, requiring multiple 0 writes to reset it.
Additionally, if 0 is written while a PWM (Pulse Width Modulation) operation is in progress, the PWM stops without the counter properly owning the underlying MTU3 channel. The fix involves checking the cached enable state and preventing redundant toggling.
How can this vulnerability impact me? :
This vulnerability can lead to incorrect runtime power management behavior, such as underflowing the usage count and accessing hardware registers when clocks are off. This may cause instability or unexpected behavior in hardware components controlled by the rz-mtu3 counter.
It can also cause PWM operations to stop unexpectedly without proper ownership, potentially disrupting hardware functions relying on PWM signals.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring system logs for the specific error message indicating a runtime PM usage count underflow.
- Check system logs for the message: "rz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!"
- Use commands like `dmesg | grep 'rz-mtu3-counter'` or `journalctl -k | grep 'rz-mtu3-counter'` to find occurrences of this message.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid writing the same enable value multiple times to the sysfs enable file for the rz-mtu3-counter device.
Specifically, ensure that writes to the sysfs enable file check against the cached count_is_enabled value and exit if the user attempts to set the same enable value repeatedly.