CVE-2026-31523: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31523 is a race condition vulnerability in the Linux kernel's nvme-pci driver, classified as a Time-of-Check Time-of-Use (TOCTOU) flaw. It affects Linux kernel versions from 5.0 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0. The vulnerability was disclosed on April 22, 2026, with patches made available the same day via GitHub Advisory GHSA-gvcv-rjfq-gg9g. It carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Feedly).

The vulnerability is rooted in a TOCTOU race condition (CWE-367) in the nvme-pci driver's queue polling logic. A user can modify the polled queue count at runtime; during a subsequent NVMe controller reset, there exists a brief window where a high-priority (hipri) task may attempt to poll a queue before the block layer has finished updating the queue maps. This causes the hipri task to poll what has become an interrupt-driven queue, potentially resulting in double completions of I/O requests. The attack vector is local, requires low privileges, and has high attack complexity due to the timing-dependent nature of the race (GitHub Advisory, Feedly).

Successful exploitation of this vulnerability can lead to double I/O completions on NVMe storage devices, which may result in data corruption, system instability, or denial of service conditions. The impact is limited to availability (no confidentiality or integrity impact per CVSS scoring), affecting systems that use NVMe storage with polled queue configurations. The scope is confined to the local system, with no evidence of lateral movement potential (Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access, low privileges, and precise timing to trigger the race condition during an NVMe reset (Feedly, GitHub Advisory).

Patches are available for all affected stable kernel branches. Administrators should update to the following fixed versions: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0. Distribution-specific updates have been released by Amazon Linux (ALAS2023-2026-1646, ALAS2023-2026-1681, ALAS2023-2026-1746, ALAS2KERNEL-5.15-2026-102) and Debian. As a temporary workaround where patching is not immediately possible, consider restricting local user access to runtime NVMe queue configuration parameters and monitoring NVMe device behavior and system logs for queue completion anomalies (GitHub Advisory, Amazon Linux ALAS).