CVE-2026-31687: gpio: omap: do not register driver in probe()
In the Linux kernel, the following vulnerability has been resolved:
gpio: omap: do not register driver in probe()
Commit 11a78b794496 ("ARM: OMAP: MPUIO wake updates") registers the omapmpuiodriver from omapmpuioinit(), which is called from omapgpioprobe().
However, it neither makes sense to register drivers from probe() callbacks of other drivers, nor does the driver core allow registering drivers with a device lock already being held.
The latter was revealed by commit dc23806a7c47 ("driver core: enforce devicelock for drivermatchdevice()") leading to a potential deadlock condition described in [1].
Additionally, the omapmpuiodriver is never unregistered from the driver core, even if the module is unloaded.
Hence, register the omapmpuiodriver from the module initcall and unregister it in moduleexit().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31687?
CVE-2026-31687 is classified as a medium severity vulnerability.
How do I fix CVE-2026-31687?
To fix CVE-2026-31687, update to the latest version of the Linux kernel where the vulnerability has been patched.
What impact does CVE-2026-31687 have on affected systems?
CVE-2026-31687 could lead to unauthorized driver registration, potentially affecting system stability.
Which versions of the Linux kernel are affected by CVE-2026-31687?
CVE-2026-31687 affects specific versions of the Linux kernel where the vulnerable code is present.
Is CVE-2026-31687 exploitable remotely?
CVE-2026-31687 is not considered remotely exploitable but could be leveraged in local privilege escalation scenarios.