CVE-2026-31687: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31687 is a denial-of-service vulnerability in the Linux kernel's GPIO OMAP driver caused by improper driver registration within a probe callback, leading to a potential deadlock condition. The flaw originates from commit 11a78b794496 ("ARM: OMAP: MPUIO wake updates"), which registers omap_mpuio_driver from omap_mpuio_init() — called during omap_gpio_probe() — while a device lock is already held. This violates driver core constraints enforced by commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()"). Affected kernel versions span from 2.6.22 up to (but not including) 5.10.251, 5.15.201, 6.1.164, 6.6.125, 6.12.72, and 6.18.11. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-833 (Deadlock) and CWE-667 (Improper Locking). The omap_mpuio_driver is registered from within omap_mpuio_init(), which is called by omap_gpio_probe() — a probe callback that already holds the device lock. The Linux driver core, after commit dc23806a7c47, enforces that driver_match_device() must not be called with the device lock held, creating a deadlock scenario when the driver registration path attempts to acquire the same lock. Additionally, the omap_mpuio_driver is never unregistered on module unload, causing a resource leak. The fix moves driver registration to the module initcall and adds proper cleanup in module_exit() (GitHub Advisory).

Successful exploitation allows a local user with the ability to trigger GPIO OMAP probe operations to cause a system deadlock, resulting in a hang or complete unresponsiveness of the affected ARM OMAP platform. The impact is limited to availability (no confidentiality or integrity loss), and is scoped to systems running ARM OMAP hardware with the affected kernel GPIO driver loaded. There is no known path for lateral movement or data exfiltration via this vulnerability (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access and the ability to trigger GPIO OMAP probe operations, limiting its attack surface to ARM OMAP-based systems. The EPSS score is approximately 0.033%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

Update the Linux kernel to a patched version: 5.10.251, 5.15.201, 6.1.164, 6.6.125, 6.12.72, 6.18.11, or later stable releases. The fix relocates omap_mpuio_driver registration from the probe callback to the module initcall and adds proper unregistration in module_exit(). As a temporary workaround on affected ARM OMAP systems, disabling the GPIO OMAP kernel module (if operationally feasible) can mitigate the risk until patching is complete (GitHub Advisory, Red Hat Bugzilla).