CVE-2026-31547

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31547", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.114Z", "datePublished": "2026-04-24T14:33:15.262Z", "dateUpdated": "2026-05-11T22:10:53.255Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:10:53.255Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix missing runtime PM reference in ccs_mode_store\n\nccs_mode_store() calls xe_gt_reset() which internally invokes\nxe_pm_runtime_get_noresume(). That function requires the caller\nto already hold an outer runtime PM reference and warns if none\nis held:\n\n [46.891177] xe 0000:03:00.0: [drm] Missing outer runtime PM protection\n [46.891178] WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at\n xe_pm_runtime_get_noresume+0x8b/0xc0\n\nFix this by protecting xe_gt_reset() with the scope-based\nguard(xe_pm_runtime)(xe), which is the preferred form when\nthe reference lifetime matches a single scope.\n\nv2:\n- Use scope-based guard(xe_pm_runtime)(xe) (Shuicheng)\n- Update commit message accordingly\n\n(cherry picked from commit 7937ea733f79b3f25e802a0c8360bf7423856f36)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"], "versions": [{"version": "480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4", "lessThan": "c409ecce9adcf815e86bc2f68834982e5a9c4e76", "status": "affected", "versionType": "git"}, {"version": "480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4", "lessThan": "65d046b2d8e0d6d855379a981869005fd6b6a41b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c409ecce9adcf815e86bc2f68834982e5a9c4e76"}, {"url": "https://git.kernel.org/stable/c/65d046b2d8e0d6d855379a981869005fd6b6a41b"}], "title": "drm/xe: Fix missing runtime PM reference in ccs_mode_store", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c409ecce9adcf815e86bc2f68834982e5a9c4e76", "status": "affected", "version": "480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4", "versionType": "git"}, {"lessThan": "65d046b2d8e0d6d855379a981869005fd6b6a41b", "status": "affected", "version": "480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix missing runtime PM reference in ccs_mode_store\n\nccs_mode_store() calls xe_gt_reset() which internally invokes\nxe_pm_runtime_get_noresume(). That function requires the caller\nto already hold an outer runtime PM reference and warns if none\nis held:\n\n [46.891177] xe 0000:03:00.0: [drm] Missing outer runtime PM protection\n [46.891178] WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at\n xe_pm_runtime_get_noresume+0x8b/0xc0\n\nFix this by protecting xe_gt_reset() with the scope-based\nguard(xe_pm_runtime)(xe), which is the preferred form when\nthe reference lifetime matches a single scope.\n\nv2:\n- Use scope-based guard(xe_pm_runtime)(xe) (Shuicheng)\n- Update commit message accordingly\n\n(cherry picked from commit 7937ea733f79b3f25e802a0c8360bf7423856f36)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe: Corrige la referencia PM de tiempo de ejecuci\u00f3n faltante en ccs_mode_store\n\nccs_mode_store() llama a xe_gt_reset() que invoca internamente a xe_pm_runtime_get_noresume(). Esa funci\u00f3n requiere que el llamador ya mantenga una referencia PM de tiempo de ejecuci\u00f3n externa y advierte si no se mantiene ninguna:\n\n [46.891177] xe 0000:03:00.0: [drm] Protecci\u00f3n PM de tiempo de ejecuci\u00f3n externa faltante\n [46.891178] ADVERTENCIA: drivers/gpu/drm/xe/xe_pm.c:885 en\n xe_pm_runtime_get_noresume+0x8b/0xc0\n\nSoluciona esto protegiendo xe_gt_reset() con el guard(xe_pm_runtime)(xe) basado en el \u00e1mbito, que es la forma preferida cuando la vida \u00fatil de la referencia coincide con un \u00fanico \u00e1mbito.\n\nv2:\n- Usa guard(xe_pm_runtime)(xe) basado en el \u00e1mbito (Shuicheng)\n- Actualiza el mensaje de commit en consecuencia\n\n(seleccionado de commit 7937ea733f79b3f25e802a0c8360bf7423856f36)"}], "id": "CVE-2026-31547", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:28.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/65d046b2d8e0d6d855379a981869005fd6b6a41b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c409ecce9adcf815e86bc2f68834982e5a9c4e76"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/xe: Fix missing runtime PM reference in ccs_mode_store", "id": "2461512", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461512"}, "csaw": false, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's `drm/xe` component. A missing runtime power management (PM) reference in the `ccs_mode_store` function could lead to a warning about missing outer runtime PM protection. This issue indicates improper resource management within the graphics driver, which may affect system stability or resource allocation."], "name": "CVE-2026-31547", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31547\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31547\nhttps://lore.kernel.org/linux-cve-announce/2026042425-CVE-2026-31547-639e@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4,c409ecce9adcf815e86bc2f68834982e5a9c4e76)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4,65d046b2d8e0d6d855379a981869005fd6b6a41b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:20:48.696573+00:00", "value": {"mitigation_remediation": ["Upgrade to a kernel release that includes the runtime PM guard fix (e.g., kernel 6.19 or any newer 7.0 release candidate).", "For custom or older kernel builds, apply the patch that surrounds xe_gt_reset with a scope\u2011based guard and rebuild the kernel. ", "Restrict permissions on the DRM XE ccs_mode sysfs entry so that only trusted users can write to it, preventing unauthorized manipulation of the GPU power state."], "summary": {"action": "Apply Patch", "impact": "Runtime PM reference missing causes unstable power management in Linux DRM XE driver"}, "threat_synthesis": {"affected_systems": "Linux kernels 6.19 and all 7.0 release candidates up to rc7 are affected, as the flaw resides in the DRM XE driver code included in those kernel releases. Any host running these kernels and exposing the DRM XE interface is vulnerable until the reference guard is added.", "description_and_impact": "When the ccs_mode_store function writes through the DRM sysfs interface, it triggers xe_gt_reset, which in turn calls xe_pm_runtime_get_noresume. That helper requires the caller to already hold a runtime power\u2011management reference, and if it is not present the kernel emits a warning about a missing outer runtime PM protection. The absence of this reference can lead to improper power state transitions for the GPU, potentially causing crashes or unexpected behavior in the graphics subsystem. The weakness is classified as a resource\u2011management defect.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% points to a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector involves a local user with the ability to write to the ccs_mode sysfs file; because that typically requires elevated privileges, the impact is most likely a local privilege escalation or system instability scenario. This inference is drawn from the fact that the ccs_mode entry is writable by privileged users and the problematic function is invoked by that write operation."}}}}, "created": "2026-04-27T19:15:11.623573+00:00", "updated": "2026-04-28T20:30:06.182504+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}