CVE-2026-31567

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31567", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.117Z", "datePublished": "2026-04-24T14:35:47.453Z", "dateUpdated": "2026-05-23T16:05:25.080Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:05:25.080Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()\n\nCommit 35e4a69b2003f (\"PM: sleep: Allow pm_restrict_gfp_mask()\nstacking\") introduced refcount-based GFP mask management that warns\nwhen pm_restore_gfp_mask() is called with saved_gfp_count == 0.\n\nSome hibernation paths call pm_restore_gfp_mask() defensively where\nthe GFP mask may or may not be restricted depending on the execution\npath. For example, the uswsusp interface invokes it in\nSNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, and snapshot_release().\nBefore the stacking change this was a silent no-op; it now triggers\na spurious WARNING.\n\nRemove the WARN_ON() wrapper from the !saved_gfp_count check while\nretaining the check itself, so that defensive calls remain harmless\nwithout producing false warnings.\n\n[ rjw: Subject tweak ]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/power/main.c"], "versions": [{"version": "35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d", "lessThan": "3025ca5daa9d682b629c0c958b538e41deeb559d", "status": "affected", "versionType": "git"}, {"version": "35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d", "lessThan": "f19d1323aa3dd7ead469aef47d9085f8939565d9", "status": "affected", "versionType": "git"}, {"version": "35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d", "lessThan": "a8d51efb5929ae308895455a3e496b5eca2cd143", "status": "affected", "versionType": "git"}, {"version": "4ddf7293928cb619077724b7d828734da8181e6c", "status": "affected", "versionType": "git"}, {"version": "6.17.8", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/power/main.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3025ca5daa9d682b629c0c958b538e41deeb559d"}, {"url": "https://git.kernel.org/stable/c/f19d1323aa3dd7ead469aef47d9085f8939565d9"}, {"url": "https://git.kernel.org/stable/c/a8d51efb5929ae308895455a3e496b5eca2cd143"}], "title": "PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/power/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3025ca5daa9d682b629c0c958b538e41deeb559d", "status": "affected", "version": "35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d", "versionType": "git"}, {"lessThan": "f19d1323aa3dd7ead469aef47d9085f8939565d9", "status": "affected", "version": "35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d", "versionType": "git"}, {"lessThan": "a8d51efb5929ae308895455a3e496b5eca2cd143", "status": "affected", "version": "35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d", "versionType": "git"}, {"status": "affected", "version": "4ddf7293928cb619077724b7d828734da8181e6c", "versionType": "git"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/power/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "57D56998-E0C3-4F58-BBF0-B20D1B4322C8", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2E98868-4027-46EE-AD08-92C9D7283181", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*", "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()\n\nCommit 35e4a69b2003f (\"PM: sleep: Allow pm_restrict_gfp_mask()\nstacking\") introduced refcount-based GFP mask management that warns\nwhen pm_restore_gfp_mask() is called with saved_gfp_count == 0.\n\nSome hibernation paths call pm_restore_gfp_mask() defensively where\nthe GFP mask may or may not be restricted depending on the execution\npath. For example, the uswsusp interface invokes it in\nSNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, and snapshot_release().\nBefore the stacking change this was a silent no-op; it now triggers\na spurious WARNING.\n\nRemove the WARN_ON() wrapper from the !saved_gfp_count check while\nretaining the check itself, so that defensive calls remain harmless\nwithout producing false warnings.\n\n[ rjw: Subject tweak ]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPM: sleep: Eliminar WARN_ON() espurio de pm_restore_gfp_mask()\n\nEl commit 35e4a69b2003f (\u2019PM: sleep: Permitir el apilamiento de pm_restrict_gfp_mask()\u2019) introdujo la gesti\u00f3n de la m\u00e1scara GFP basada en recuento de referencias que advierte cuando se llama a pm_restore_gfp_mask() con saved_gfp_count == 0.\n\nAlgunas rutas de hibernaci\u00f3n llaman a pm_restore_gfp_mask() de forma defensiva donde la m\u00e1scara GFP puede o no estar restringida dependiendo de la ruta de ejecuci\u00f3n. Por ejemplo, la interfaz uswsusp lo invoca en SNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE y snapshot_release(). Antes del cambio de apilamiento, esto era una operaci\u00f3n nula silenciosa; ahora activa una ADVERTENCIA espuria.\n\nEliminar el envoltorio WARN_ON() de la comprobaci\u00f3n !saved_gfp_count mientras se mantiene la comprobaci\u00f3n en s\u00ed, para que las llamadas defensivas sigan siendo inofensivas sin producir advertencias falsas.\n\n[ rjw: Ajuste del asunto ]"}], "id": "CVE-2026-31567", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-24T15:16:31.197", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3025ca5daa9d682b629c0c958b538e41deeb559d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a8d51efb5929ae308895455a3e496b5eca2cd143"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f19d1323aa3dd7ead469aef47d9085f8939565d9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()", "id": "2461552", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461552"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-440", "details": ["A flaw was found in the Linux kernel. When the `pm_restore_gfp_mask()` function is invoked during certain hibernation processes, it can erroneously trigger a warning. This leads to the generation of spurious (false) warning messages in system logs, which may obscure legitimate issues and cause minor operational overhead."], "name": "CVE-2026-31567", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31567\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31567\nhttps://lore.kernel.org/linux-cve-announce/2026042400-CVE-2026-31567-6abf@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d,3025ca5daa9d682b629c0c958b538e41deeb559d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d,f19d1323aa3dd7ead469aef47d9085f8939565d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d,a8d51efb5929ae308895455a3e496b5eca2cd143)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "4ddf7293928cb619077724b7d828734da8181e6c"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T01:41:47.215600+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a version that incorporates the removal of the spurious WARN_ON() in pm_restore_gfp_mask()", "If an upgrade is not immediately possible, monitor system logs for excessive \"WARN_ON entries from pm_restore_gfp_mask()\" to prevent misdiagnosis of actual issues", "Configure log rotation or syslog restrictions to limit the impact of spurious warnings on log storage and alerting systems"], "summary": {"action": "Apply patch", "impact": "False warning flooding and misleading diagnostics, which can obscure legitimate alerts and potentially affect log\u2011based monitoring systems"}, "threat_synthesis": {"affected_systems": "The issue affects all Linux kernel releases that incorporated commit 35e4a69b2003f without the subsequent fix. No specific version range is provided in the CNA data, but the vulnerability is present in the kernel source before the removal of the WARN_ON() wrapper. Systems running older kernels that have not yet applied this patch are susceptible.", "description_and_impact": "A recent change to the Linux kernel introduced a spurious warning in the power management subsystem \u2013 specifically when pm_restore_gfp_mask() is called in hibernation paths that may or may not have a restricted GFP mask. The added WARN_ON() triggers a console warning even when the function call is defensive and benign, leading to unnecessary log entries but no direct compromise of confidentiality, integrity or availability. The impact is primarily operational, as it can overwhelm system logs or mislead operators into thinking a real problem exists.", "risk_and_exploitability": "With a CVSS score of 5.5 the vulnerability is considered moderate. The EPSS score is below 1\u2009% and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating a low likelihood of exploitation. The issue is local to the kernel and requires privileged execution; an attacker would need to execute or influence kernel code to trigger these warnings, which does not provide any direct foothold or privilege escalation. The primary risk lies in operational noise rather than security compromise."}}}}, "created": "2026-04-27T19:00:15.754236+00:00", "updated": "2026-04-29T01:45:26.031256+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}