CyberSecBulletin
CVE-2026-31667NVD status: Modified

Linux: Improper Locking

Published Updated By the CyberSecBulletin desk

CVE-2026-31667 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 71a9729f412e2c692a35c542e14b706fb342927f, 271ee71a1917b89f6d73ec82dd091c33d92ee617, 974f7b138c3a96dd5cd53d1b33409cd7b2229dc6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 71a9729f412e2c692a35c542e14b706fb342927f or 271ee71a1917b89f6d73ec82dd091c33d92ee617 or 974f7b138c3a96dd5cd53d1b33409cd7b2229dc6 or 546c18a14924eb521fe168d916d7ce28f1e13c1d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.169 or 6.6.135, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxff462551235d8d7d843a005950bc90924fcedede up to, but not including, 71a9729f412e2c692a35c542e14b706fb342927f; ff462551235d8d7d843a005950bc90924fcedede up to, but not including, 271ee71a1917b89f6d73ec82dd091c33d92ee617; ff462551235d8d7d843a005950bc90924fcedede up to, but not including, 974f7b138c3a96dd5cd53d1b33409cd7b2229dc6; ff462551235d8d7d843a005950bc90924fcedede up to, but not including, 546c18a14924eb521fe168d916d7ce28f1e13c1d; ff462551235d8d7d843a005950bc90924fcedede up to, but not including, a3d6c9c053c9c605651508569230ead633b13f76; ff462551235d8d7d843a005950bc90924fcedede up to, but not including, 1e09dfbb4f5d20ee111f92325a00f85778a5f328; ff462551235d8d7d843a005950bc90924fcedede up to, but not including, 1534661043c434b81cfde26b97a2fb2460329cf0; ff462551235d8d7d843a005950bc90924fcedede up to, but not including, 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2; and 1 more ranges71a9729f412e2c692a35c542e14b706fb342927f, 271ee71a1917b89f6d73ec82dd091c33d92ee617, 974f7b138c3a96dd5cd53d1b33409cd7b2229dc6, 546c18a14924eb521fe168d916d7ce28f1e13c1d, a3d6c9c053c9c605651508569230ead633b13f76, 1e09dfbb4f5d20ee111f92325a00f85778a5f328
LinuxLinux Kernel2.6.19.1 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.169; 6.2 up to, but not including, 6.6.135; 6.7 up to, but not including, 6.12.82; 6.13 up to, but not including, 6.18.23; 6.19 up to, but not including, 6.19.13; 2.6.19; and 1 more ranges5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: Input: uinput - fix circular locking dependency with ff-core A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for example, playing ELDEN RING under Wine with a Flydigi Vader 5 controller): ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex The cycle is caused by four lock acquisition paths: 1. ff upload: input_ff_upload() holds ff->mutex and calls uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), which acquires udev->mutex. 2. device create: uinput_ioctl_handler() holds udev->mutex and calls uinput_create_device() -> input_register_device(), which acquires input_mutex. 3. device register: input_register_device() holds input_mutex and calls kbd_connect() -> input_register_handle(), which acquires dev->mutex. 4. evdev release: evdev_release() calls input_flush_device() under dev->mutex, which calls input_ff_flush() acquiring ff->mutex. Fix this by introducing a new state_lock spinlock to protect udev->state and udev->dev access in uinput_request_send() instead of acquiring udev->mutex. The function only needs to atomically check device state and queue an input event into the ring buffer via uinput_dev_event() -- both operations are safe under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in the lock ordering and cannot form cycles with mutexes. To keep state transitions visible to uinput_request_send(), protect writes to udev->state in uinput_create_device() and uinput_destroy_device() with the same state_lock spinlock. Additionally, move init_completion(&request->done) from uinput_request_send() to uinput_request_submit() before uinput_request_reserve_slot(). Once the slot is allocated, uinput_flush_requests() may call complete() on it at any time from the destroy path, so the completion must be initialised before the request becomes visible. Lock ordering after the fix: ff->mutex -> state_lock (spinlock, leaf) udev->mutex -> state_lock (spinlock, leaf) udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How developers prevent this class of flaw

  • Use industry standard APIs to implement locking mechanism.

More Improper Locking vulnerabilities (CWE-667)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Locking vulnerabilities

Spotted an error? Tell us.