CVE-2026-31740: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31740 is a race condition vulnerability in the Linux kernel's rz-mtu3-cnt counter driver, caused by missing synchronization (CWE-820) when both the counter and PWM sub-drivers attempt to assign their own struct device pointer to the shared struct rz_mtu3_channel's dev member. Depending on probe order, the dev member may point to the wrong device instance, causing the counter sub-driver to perform runtime power management (PM) operations on the wrong device. It was published on May 1, 2026, and affects Linux kernel versions 6.4–6.6.134, 6.7–6.12.81, 6.13–6.18.22, 6.19–6.19.12, and 7.0 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a missing synchronization mechanism (CWE-820) in the Linux kernel's rz-mtu3-cnt driver. The counter driver uses hardware channels 1 and 2, while the PWM driver uses channels 0, 1, 2, 3, 4, 6, and 7 — meaning channels 1 and 2 are shared. Both sub-drivers race during probe to write their own struct device * into the same rz_mtu3_channel.dev field, overwriting each other's value. The counter sub-driver subsequently uses this dev pointer for runtime PM calls; if the PWM driver's pointer wins the race, the counter driver will invoke PM operations on the PWM device instead of its own, leading to incorrect power state management. The fix replaces the use of rz_mtu3_channel.dev with the counter's own parent pointer, which is correctly assigned during probe (GitHub Advisory).

Exploitation of this vulnerability can cause the counter sub-driver to perform runtime PM actions on the wrong device instance, leading to system instability, device power state mismanagement, or resource allocation failures on hardware using the RZ MTU3 peripheral. The impact is limited to availability (no confidentiality or integrity impact), and exploitation requires local access with low privileges. Affected systems include embedded Linux platforms using the Renesas RZ MTU3 hardware with both counter and PWM drivers loaded (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term (GitHub Advisory).

Patches have been released for all affected stable kernel branches. Users should upgrade to Linux kernel versions 6.6.134, 6.12.81, 6.18.22, or 6.19.12 (or later), which contain the fix replacing the shared rz_mtu3_channel.dev pointer with the counter's parent device pointer for runtime PM operations. Systems running the RZ MTU3 hardware with both counter and PWM drivers should prioritize applying these updates. No configuration-based workaround is available; kernel update is the only remediation (GitHub Advisory, Red Hat Bugzilla).