CVE-2026-31462: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31462 is a race condition vulnerability in the Linux kernel's AMD GPU (drm/amdgpu) driver related to immediate PASID (Process Address Space ID) reuse. When a process exits and frees its PASID, a new process may immediately receive the same PASID before pending page fault interrupts from the previous process have been cleared from the interrupt handler (IH) ring buffer, causing incorrect interrupt handling. The vulnerability affects Linux kernel versions from 4.15 up to (but not including) 6.12.80, 6.13 through 6.18.21, 6.19 through 6.19.11, and 7.0 release candidates. It was published on April 22, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-367 (Time-of-Check Time-of-Use / TOCTOU Race Condition). When a process terminates and releases its PASID, the kernel's drm/amdgpu driver previously allowed immediate reallocation of that same PASID to a new process. Because page fault interrupts for the exiting process may still be queued in the IH ring buffer at the time of PASID release, the newly spawned process inheriting the same PASID can encounter those stale interrupts, leading to incorrect hardware state handling. The fix adopts an IDR cyclic allocator — analogous to the kernel's own PID allocation strategy — to ensure PASID values are not immediately reused, giving pending interrupts time to drain (Github Advisory, Feedly).

Successful exploitation of this vulnerability results in a high availability impact with no confidentiality or integrity loss. A local user with low privileges on a system equipped with an AMD GPU can trigger GPU memory management instability, incorrect interrupt handling, and unpredictable behavior in amdgpu driver operations, potentially causing system instability or denial of service for GPU-dependent workloads. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (roughly 3rd percentile), indicating a very low probability of exploitation in the near term (Github Advisory). Exploitation requires local access and low privileges, limiting the attack surface primarily to multi-tenant or shared systems with AMD GPUs.

Patches have been released for the affected kernel stable branches. Users should upgrade to Linux kernel version 6.12.80 or later, 6.18.21 or later, 6.19.11 or later, or 7.0 (once released) to remediate the vulnerability (Github Advisory, Feedly). The upstream fix (commit 8f1de51f49be692de137c8525106e0fce2d1912d) is cherry-picked into the stable branches at commits c0b3882836de, 51ccaf0e30c3, 9e5ebfe99b22, and 14b81abe7bdc. As a temporary workaround, administrators can limit the rate of rapid process creation and destruction on systems with AMD GPUs to reduce the likelihood of triggering the race condition, though patching is the definitive solution (Feedly).