CVE-2026-31391: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31391 is a denial-of-service vulnerability in the Linux kernel's atmel-sha204a cryptographic driver caused by a ->tfm_count counter leak on out-of-memory (OOM) conditions. When a memory allocation fails during driver initialization, the ->tfm_count counter is not properly decremented, leaving it in an elevated state that blocks all future legitimate reads from the Atmel SHA204A hardware security device. The vulnerability affects Linux kernel versions from 5.3 through multiple stable branches up to (but not including) the patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector requiring low privileges (GitHub Advisory, Feedly).

The root cause is improper resource cleanup on error paths (CWE-459: Incomplete Cleanup) in the atmel-sha204a crypto driver. When memory allocation fails during a transform (tfm) setup, the driver increments ->tfm_count but fails to decrement it upon the allocation error, leaving the counter permanently elevated. This causes the driver's read gate logic to treat the device as busy, blocking all subsequent legitimate access attempts to the cryptographic hardware. Exploitation requires local access and the ability to trigger memory pressure conditions on a system equipped with Atmel SHA204A hardware (GitHub Advisory).

A local attacker with low privileges can permanently disable the atmel-sha204a cryptographic subsystem on affected systems by triggering a memory allocation failure, causing all subsequent reads from the hardware security device to be blocked indefinitely. This results in a denial-of-service condition limited to the cryptographic hardware's availability, with no confidentiality or integrity impact. Systems relying on the Atmel SHA204A for hardware-backed cryptographic operations (e.g., key storage, secure boot attestation) would lose access to those functions until the kernel is restarted (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (Feedly). Exploitation is constrained to systems with Atmel SHA204A hardware and requires local access under memory-constrained conditions.

Update the Linux kernel to one of the following patched versions based on your branch: 5.10.253 or later, 6.1.167 or later, 6.6.130 or later, 6.12.78 or later, 6.18.20 or later, 6.19.10 or later, or the 7.0 final release. Patches have been committed to the stable kernel trees and are available via the kernel.org stable repository (GitHub Advisory). Systems using atmel-sha204a hardware should prioritize patching to restore cryptographic subsystem reliability. As a temporary workaround, unloading the atmel-sha204a kernel module (if not required) can prevent exploitation until a patch is applied.