CyberSecBulletin
CVE-2026-31557NVD status: Modified

Linux: Improper Locking

Published Updated By the CyberSecBulletin desk

CVE-2026-31557 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions ede147a85d1d4c075d13ba190453d6b09ecbea37, a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec, 49c7c50ee6325a084216e94395e067ecde8088fa as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.45% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ede147a85d1d4c075d13ba190453d6b09ecbea37 or a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec or 49c7c50ee6325a084216e94395e067ecde8088fa or ca111c9d8d6c9d5735878d933a1716c4be86c2d1, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.16 or 5.18 or 6.12.80 or 6.18.21, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux8832cf922151e9dfa2821736beb0ae2dd3968b6e up to, but not including, ede147a85d1d4c075d13ba190453d6b09ecbea37; 8832cf922151e9dfa2821736beb0ae2dd3968b6e up to, but not including, a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec; 8832cf922151e9dfa2821736beb0ae2dd3968b6e up to, but not including, 49c7c50ee6325a084216e94395e067ecde8088fa; 8832cf922151e9dfa2821736beb0ae2dd3968b6e up to, but not including, ca111c9d8d6c9d5735878d933a1716c4be86c2d1; 8832cf922151e9dfa2821736beb0ae2dd3968b6e up to, but not including, 25ceffc1dabec3b93f458b437aae26f4da293f87; 8832cf922151e9dfa2821736beb0ae2dd3968b6e up to, but not including, 2922e3507f6d5caa7f1d07f145e186fc6f317a4e; d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9; 84026f8c9357c62a9d3e4c554ffd10ccab813654; and 3 more rangesede147a85d1d4c075d13ba190453d6b09ecbea37, a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec, 49c7c50ee6325a084216e94395e067ecde8088fa, ca111c9d8d6c9d5735878d933a1716c4be86c2d1, 25ceffc1dabec3b93f458b437aae26f4da293f87, 2922e3507f6d5caa7f1d07f145e186fc6f317a4e
LinuxLinux Kernel5.15.42 up to, but not including, 5.16; 5.17.10 up to, but not including, 5.18; 5.18.1 up to, but not including, 6.12.80; 6.13 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; 5.18; 7.05.16, 5.18, 6.12.80, 6.18.21, 6.19.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: nvmet: move async event work off nvmet-wq For target nvmet_ctrl_free() flushes ctrl->async_event_work. If nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue completion for the same worker:- A. Async event work queued on nvmet-wq (prior to disconnect): nvmet_execute_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) nvmet_add_async_event() queue_work(nvmet_wq, &ctrl->async_event_work) B. Full pre-work chain (RDMA CM path): nvmet_rdma_cm_handler() nvmet_rdma_queue_disconnect() __nvmet_rdma_queue_disconnect() queue_work(nvmet_wq, &queue->release_work) process_one_work() lock((wq_completion)nvmet-wq) <--------- 1st nvmet_rdma_release_queue_work() C. Recursive path (same worker): nvmet_rdma_release_queue_work() nvmet_rdma_free_queue() nvmet_sq_destroy() nvmet_ctrl_put() nvmet_ctrl_free() flush_work(&ctrl->async_event_work) __flush_work() touch_wq_lockdep_map() lock((wq_completion)nvmet-wq) <--------- 2nd Lockdep splat: ============================================ WARNING: possible recursive locking detected 6.19.0-rc3nvme+ #14 Tainted: G N -------------------------------------------- kworker/u192:42/44933 is trying to acquire lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90 but task is already holding lock: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 3 locks held by kworker/u192:42/44933: #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660 #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660 #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530 Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma] Call Trace: __flush_work+0x268/0x530 nvmet_ctrl_free+0x140/0x310 [nvmet] nvmet_cq_put+0x74/0x90 [nvmet] nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma] nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma] process_one_work+0x206/0x660 worker_thread+0x184/0x320 kthread+0x10c/0x240 ret_from_fork+0x319/0x390 Move async event work to a dedicated nvmet-aen-wq to avoid reentrant flush on nvmet-wq.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How developers prevent this class of flaw

  • Use industry standard APIs to implement locking mechanism.

More Improper Locking vulnerabilities (CWE-667)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Locking vulnerabilities

Spotted an error? Tell us.