CVE-2026-31741

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31741", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.138Z", "datePublished": "2026-05-01T14:14:36.845Z", "dateUpdated": "2026-05-11T22:14:51.833Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:14:51.833Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncounter: rz-mtu3-cnt: prevent counter from being toggled multiple times\n\nRuntime PM counter is incremented / decremented each time the sysfs\nenable file is written to.\n\nIf user writes 0 to the sysfs enable file multiple times, runtime PM\nusage count underflows, generating the following message.\n\nrz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!\n\nAt the same time, hardware registers end up being accessed with clocks\noff in rz_mtu3_terminate_counter() to disable an already disabled\nchannel.\n\nIf user writes 1 to the sysfs enable file multiple times, runtime PM\nusage count will be incremented each time, requiring the same number of\n0 writes to get it back to 0.\n\nIf user writes 0 to the sysfs enable file while PWM is in progress, PWM\nis stopped without counter being the owner of the underlying MTU3\nchannel.\n\nCheck against the cached count_is_enabled value and exit if the user\nis trying to set the same enable value."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/counter/rz-mtu3-cnt.c"], "versions": [{"version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "lessThan": "885aa739a07ab45e90dfa997205acec97979ce4e", "status": "affected", "versionType": "git"}, {"version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "lessThan": "ced8b48420eddb1251f93c22dc23fa136490b3cd", "status": "affected", "versionType": "git"}, {"version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "lessThan": "e07237df8538b0ae98dce112e4f6db093d767f80", "status": "affected", "versionType": "git"}, {"version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "lessThan": "f5f6f06d7e6d262026578b59ba7426eb04acce5d", "status": "affected", "versionType": "git"}, {"version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "lessThan": "67c3f99bed6f422ba343d2b70a2eeeccdfd91bef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/counter/rz-mtu3-cnt.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/885aa739a07ab45e90dfa997205acec97979ce4e"}, {"url": "https://git.kernel.org/stable/c/ced8b48420eddb1251f93c22dc23fa136490b3cd"}, {"url": "https://git.kernel.org/stable/c/e07237df8538b0ae98dce112e4f6db093d767f80"}, {"url": "https://git.kernel.org/stable/c/f5f6f06d7e6d262026578b59ba7426eb04acce5d"}, {"url": "https://git.kernel.org/stable/c/67c3f99bed6f422ba343d2b70a2eeeccdfd91bef"}], "title": "counter: rz-mtu3-cnt: prevent counter from being toggled multiple times", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/counter/rz-mtu3-cnt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "885aa739a07ab45e90dfa997205acec97979ce4e", "status": "affected", "version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "versionType": "git"}, {"lessThan": "ced8b48420eddb1251f93c22dc23fa136490b3cd", "status": "affected", "version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "versionType": "git"}, {"lessThan": "e07237df8538b0ae98dce112e4f6db093d767f80", "status": "affected", "version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "versionType": "git"}, {"lessThan": "f5f6f06d7e6d262026578b59ba7426eb04acce5d", "status": "affected", "version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "versionType": "git"}, {"lessThan": "67c3f99bed6f422ba343d2b70a2eeeccdfd91bef", "status": "affected", "version": "0be8907359df4c62319f5cb2c6981ff0d9ebf35a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/counter/rz-mtu3-cnt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1AFB41D-EE40-4D1A-93ED-E8655E9E65C4", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncounter: rz-mtu3-cnt: prevent counter from being toggled multiple times\n\nRuntime PM counter is incremented / decremented each time the sysfs\nenable file is written to.\n\nIf user writes 0 to the sysfs enable file multiple times, runtime PM\nusage count underflows, generating the following message.\n\nrz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!\n\nAt the same time, hardware registers end up being accessed with clocks\noff in rz_mtu3_terminate_counter() to disable an already disabled\nchannel.\n\nIf user writes 1 to the sysfs enable file multiple times, runtime PM\nusage count will be incremented each time, requiring the same number of\n0 writes to get it back to 0.\n\nIf user writes 0 to the sysfs enable file while PWM is in progress, PWM\nis stopped without counter being the owner of the underlying MTU3\nchannel.\n\nCheck against the cached count_is_enabled value and exit if the user\nis trying to set the same enable value."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncounter: rz-mtu3-cnt: evitar que el contador sea conmutado m\u00faltiples veces\n\nEl contador de PM en tiempo de ejecuci\u00f3n se incrementa / decrementa cada vez que se escribe en el archivo de habilitaci\u00f3n de sysfs.\n\nSi el usuario escribe 0 en el archivo de habilitaci\u00f3n de sysfs varias veces, el recuento de uso de PM en tiempo de ejecuci\u00f3n sufre un subdesbordamiento, generando el siguiente mensaje.\n\nrz-mtu3-counter rz-mtu3-counter.0: \u00a1Subdesbordamiento del recuento de uso de PM en tiempo de ejecuci\u00f3n!\n\nAl mismo tiempo, los registros de hardware terminan siendo accedidos con los relojes apagados en rz_mtu3_terminate_counter() para deshabilitar un canal ya deshabilitado.\n\nSi el usuario escribe 1 en el archivo de habilitaci\u00f3n de sysfs varias veces, el recuento de uso de PM en tiempo de ejecuci\u00f3n se incrementar\u00e1 cada vez, requiriendo el mismo n\u00famero de escrituras de 0 para devolverlo a 0.\n\nSi el usuario escribe 0 en el archivo de habilitaci\u00f3n de sysfs mientras PWM est\u00e1 en curso, PWM se detiene sin que el contador sea el propietario del canal MTU3 subyacente.\n\nVerificar contra el valor almacenado en cach\u00e9 de count_is_enabled y salir si el usuario est\u00e1 intentando establecer el mismo valor de habilitaci\u00f3n."}], "id": "CVE-2026-31741", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-01T15:16:36.820", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/67c3f99bed6f422ba343d2b70a2eeeccdfd91bef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/885aa739a07ab45e90dfa997205acec97979ce4e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ced8b48420eddb1251f93c22dc23fa136490b3cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e07237df8538b0ae98dce112e4f6db093d767f80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f5f6f06d7e6d262026578b59ba7426eb04acce5d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: counter: rz-mtu3-cnt: prevent counter from being toggled multiple times", "id": "2464501", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464501"}, "csaw": false, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's `rz-mtu3-cnt` counter module. A local user can exploit this by repeatedly writing '0' to the sysfs enable file, which causes the runtime Power Management (PM) usage count to underflow. This can lead to attempts to access hardware registers with their clocks off, potentially causing system instability or a denial of service (DoS). Additionally, repeated writes of '1' can cause the usage count to increment indefinitely, requiring an equal number of '0' writes to reset it."], "name": "CVE-2026-31741", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31741\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31741\nhttps://lore.kernel.org/linux-cve-announce/2026050139-CVE-2026-31741-08c6@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0be8907359df4c62319f5cb2c6981ff0d9ebf35a,885aa739a07ab45e90dfa997205acec97979ce4e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0be8907359df4c62319f5cb2c6981ff0d9ebf35a,ced8b48420eddb1251f93c22dc23fa136490b3cd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0be8907359df4c62319f5cb2c6981ff0d9ebf35a,e07237df8538b0ae98dce112e4f6db093d767f80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0be8907359df4c62319f5cb2c6981ff0d9ebf35a,f5f6f06d7e6d262026578b59ba7426eb04acce5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0be8907359df4c62319f5cb2c6981ff0d9ebf35a,67c3f99bed6f422ba343d2b70a2eeeccdfd91bef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T16:30:20.418551+00:00", "updated": "2026-05-07T22:45:24.406766+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}