CVE-2026-31687 gpio: omap: do not register driver in probe()
A race condition in the Linux kernel GPIO driver can cause a deadlock, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31687?
CVE-2026-31687 is a medium-severity vulnerability in Linux kernel, published on 27 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gpio: omap: do not register driver in probe()
Commit 11a78b794496 ("ARM: OMAP: MPUIO wake updates") registers the omap_mpuio_driver from omap_mpuio_init(), which is called from omap_gpio_probe().
However, it neither makes sense to register drivers from probe() callbacks of other drivers, nor does the driver core allow registering drivers with a device lock already being held.
The latter was revealed by commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") leading to a potential deadlock condition described in [1].
Additionally, the omap_mpuio_driver is never unregistered from the driver core, even if the module is unloaded.
Hence, register the omap_mpuio_driver from the module initcall and unregister it in module_exit().
Weakness: CWE-667
Which versions are affected by CVE-2026-31687?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31687?
Apply the vendor's patch.
Is CVE-2026-31687 being exploited?
There is no known exploitation of CVE-2026-31687 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31687, DEBIAN-CVE-2026-31687, GHSA-wvmf-v9m3-rvrr, ROOT-OS-UBUNTU-2204-CVE-2026-31687, ROOT-OS-UBUNTU-2404-CVE-2026-31687, UBUNTU-CVE-2026-31687.