CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential deadlock in cpu hotplug with osnoise
The following sequence may leads deadlock in cpu hotplug:
task1 task2 task3 ----- ----- -----
mutexlock(&interfacelock)
[CPU GOING OFFLINE]
cpuswritelock(); osnoisecpudie(); kthreadstop(task3); waitforcompletion();
osnoisesleep(); mutexlock(&interfacelock);
cpusreadlock();
[DEAD LOCK]
Fix by swap the order of cpusreadlock() and mutexlock(&interfacelock).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What conditions are required for this deadlock to occur?
The deadlock requires CPU hotplug activity, specifically a CPU going offline, while osnoise task shutdown and an interface_lock holder contend with CPU read/write locking. The described sequence involves osnoise_cpu_die() stopping a task and waiting for its completion.
What is the operational impact if the issue is triggered?
CPU hotplug can deadlock. This can prevent the affected CPU-offline operation from completing and cause an availability impact.
Is remote exploitation indicated by the available severity data?
No. The supplied vector identifies local access as required (AV:L), low attack complexity, low privileges required, and no user interaction.