Linux: Improper Locking
CVE-2026-31486 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions f0c9ea9c3a208e79c812e10e2bcef87b46564f01, b26849cffaa7c43355b82e9bef3725e786973a1a, acf04e2863132f6d9222f71f3a76fb9782cbe061 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to f0c9ea9c3a208e79c812e10e2bcef87b46564f01 or b26849cffaa7c43355b82e9bef3725e786973a1a or acf04e2863132f6d9222f71f3a76fb9782cbe061 or 4e9d723d9f198b86f6882a84c501ba1f39e8d055, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.18.21 or 6.19.11, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7 up to, but not including, f0c9ea9c3a208e79c812e10e2bcef87b46564f01; ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7 up to, but not including, b26849cffaa7c43355b82e9bef3725e786973a1a; ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7 up to, but not including, acf04e2863132f6d9222f71f3a76fb9782cbe061; ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7 up to, but not including, 4e9d723d9f198b86f6882a84c501ba1f39e8d055; ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7 up to, but not including, 2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07; ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7 up to, but not including, 754bd2b4a084b90b5e7b630e1f423061a9b9b761; 3.19 | f0c9ea9c3a208e79c812e10e2bcef87b46564f01, b26849cffaa7c43355b82e9bef3725e786973a1a, acf04e2863132f6d9222f71f3a76fb9782cbe061, 4e9d723d9f198b86f6882a84c501ba1f39e8d055, 2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07, 754bd2b4a084b90b5e7b630e1f423061a9b9b761 |
| Linux | Linux Kernel | 3.19.1 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; 3.19; 7.0 | 6.18.21, 6.19.11 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Improper Locking vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.8 High severity
Apple Multiple Products Improper Locking Exploited
- 7.2 High severity
- 7.8 High severity
Spotted an error? Tell us.