{"id":"CVE-2026-31557","aliases":[],"cve":{"records":[{"id":"CVE-2026-31557","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-03-09T15:48:24.116Z","published":"2026-04-24T14:35:40.544Z","modified":"2026-10-30T12:24:20.397Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:24:20.397Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-19T18:55:58.971Z"}],"references":[{"url":"https://git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e","tags":[],"source":"Linux"}],"weaknesses":[{"id":"CWE-667","description":"CWE-667 Improper Locking","source":"CISA-ADP"}],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.10"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-16T15:10:53.279331Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"nvmet: move async event work off nvmet-wq","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: move async event work off nvmet-wq\n\nFor target nvmet_ctrl_free() flushes ctrl->async_event_work.\nIf nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue\ncompletion for the same worker:-\n\nA. Async event work queued on nvmet-wq (prior to disconnect):\n  nvmet_execute_async_event()\n     queue_work(nvmet_wq, &ctrl->async_event_work)\n\n  nvmet_add_async_event()\n     queue_work(nvmet_wq, &ctrl->async_event_work)\n\nB. Full pre-work chain (RDMA CM path):\n  nvmet_rdma_cm_handler()\n     nvmet_rdma_queue_disconnect()\n       __nvmet_rdma_queue_disconnect()\n         queue_work(nvmet_wq, &queue->release_work)\n           process_one_work()\n             lock((wq_completion)nvmet-wq)  <--------- 1st\n             nvmet_rdma_release_queue_work()\n\nC. Recursive path (same worker):\n  nvmet_rdma_release_queue_work()\n     nvmet_rdma_free_queue()\n       nvmet_sq_destroy()\n         nvmet_ctrl_put()\n           nvmet_ctrl_free()\n             flush_work(&ctrl->async_event_work)\n               __flush_work()\n                 touch_wq_lockdep_map()\n                 lock((wq_completion)nvmet-wq) <--------- 2nd\n\nLockdep splat:\n\n  ============================================\n  WARNING: possible recursive locking detected\n  6.19.0-rc3nvme+ #14 Tainted: G                 N\n  --------------------------------------------\n  kworker/u192:42/44933 is trying to acquire lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n\n  but task is already holding lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n\n  3 locks held by kworker/u192:42/44933:\n   #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n   #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660\n   #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530\n\n  Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]\n  Call Trace:\n   __flush_work+0x268/0x530\n   nvmet_ctrl_free+0x140/0x310 [nvmet]\n   nvmet_cq_put+0x74/0x90 [nvmet]\n   nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]\n   nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]\n   process_one_work+0x206/0x660\n   worker_thread+0x184/0x320\n   kthread+0x10c/0x240\n   ret_from_fork+0x319/0x390\n\nMove async event work to a dedicated nvmet-aen-wq to avoid reentrant\nflush on nvmet-wq.","score":7.5,"severity":"high","published":"2026-04-24T14:35:40.544Z","modified":"2026-10-30T12:24:20.397Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"ede147a85d1d4c075d13ba190453d6b09ecbea37","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"49c7c50ee6325a084216e94395e067ecde8088fa","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"ca111c9d8d6c9d5735878d933a1716c4be86c2d1","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"25ceffc1dabec3b93f458b437aae26f4da293f87","versionType":"git"},{"version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","status":"affected","lessThan":"2922e3507f6d5caa7f1d07f145e186fc6f317a4e","versionType":"git"},{"version":"d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9","status":"affected","versionType":"git"},{"version":"84026f8c9357c62a9d3e4c554ffd10ccab813654","status":"affected","versionType":"git"},{"version":"5.15.42","status":"affected","lessThan":"5.16","versionType":"semver"},{"version":"5.17.10","status":"affected","lessThan":"5.18","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-31557"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"5.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.18","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-31557"}],"remediation":[],"references":["https://git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37","https://git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa","https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1","https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87","https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e"],"sources":[{"name":"CVE","id":"CVE-2026-31557","modified":"2026-10-30T12:24:20.397Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-31557"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T12:49:22.117Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T07:10:30.687Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}