CVE-2026-31550: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31550 is a Linux kernel vulnerability in the bcm2835-power power management domain driver affecting BCM2711-based systems (e.g., Raspberry Pi 4). The flaw stems from an insufficient polling timeout in the bcm2835_asb_control() function, which causes intermittent ASB (Arbitration Synchronization Bridge) handshake failures during runtime PM suspend operations, particularly for the V3D GPU's master ASB. It was published on April 24, 2026, and affects Linux kernel versions from 5.1 through multiple stable branches up to 6.19. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-821 (Incorrect Synchronization): the bcm2835_asb_control() function uses a tight polling loop with a 1-microsecond timeout — implemented via an open-coded ktime_get_ns()/cpu_relax() loop — that is insufficient under intensive workloads on BCM2711 hardware. When the ASB bridge does not acknowledge a power-domain request within this window, the function returns an error without properly completing the power-off sequence. The fix increases the timeout to 5 microseconds and replaces the custom loop with the kernel's readl_poll_timeout_atomic() helper for improved reliability. This is a local, low-privilege issue requiring no user interaction; exploitation is limited to systems running BCM2711 hardware with V3D GPU activity (Red Hat CVE, Feedly).

When the ASB handshake fails during runtime PM suspend, the V3D GPU is left in a broken state. Subsequent GPU accesses then trigger bus faults or complete system hangs, resulting in a denial of service for graphics-intensive workloads on affected BCM2711 systems. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H), and there is no known potential for lateral movement or data exposure (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term (Feedly).

• Logs: Kernel log messages containing "Failed to disable ASB master for v3d" during runtime PM suspend operations on BCM2711 systems.
• System Behavior: Unexpected system hangs or bus fault errors following GPU-intensive workloads on Raspberry Pi 4 or other BCM2711-based devices.
• Process/Kernel: Kernel oops or BUG traces in dmesg related to V3D GPU access after a failed power domain transition.

Update to a patched Linux kernel version: 5.10.253 or later (5.10.x branch), 5.15.203 or later (5.15.x branch), 6.1.167 or later (6.1.x branch), 6.6.130 or later (6.6.x branch), 6.12.78 or later (6.12.x branch), 6.18.20 or later (6.18.x branch), 6.19.10 or later (6.19.x branch), or 7.0 or later. Patches are available via multiple upstream kernel stable commits and have been incorporated into Red Hat, SUSE, and Debian distributions. Prioritize patching on BCM2711-based systems running graphics-intensive workloads. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Red Hat CVE, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (BZ#2461504) and published a CVE advisory. SUSE issued multiple security update announcements (SUSE-SU-202621834-1, SUSE-SU-20262217-1, SUSE-SU-20262238-1) addressing this CVE. Debian accepted the fix into its oldoldstable-security repository. The Yocto Project security mailing list also flagged the issue. No notable independent researcher commentary or significant social media discussion has been observed (Red Hat CVE, Red Hat Bugzilla).