CVE-2026-31480: Linux Kernel CPU Hotplug DoS Vulnerability

CVE-2026-31480 Overview

A deadlock vulnerability has been identified in the Linux kernel's tracing subsystem, specifically within the osnoise component during CPU hotplug operations. The vulnerability occurs due to improper lock ordering between cpus_read_lock() and mutex_lock(&interface_lock), which can result in a system-wide deadlock when CPUs are brought offline while the osnoise tracer is active.

Critical Impact

This vulnerability can cause a complete system hang through deadlock, rendering affected Linux systems unresponsive and requiring a hard reset to recover.

Affected Products

• Linux kernel with osnoise tracing support
• Linux kernel versions with CPU hotplug functionality
• Systems utilizing real-time tracing and latency measurement features

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-31480 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31480

Vulnerability Analysis

This deadlock vulnerability arises from a race condition in the Linux kernel's osnoise tracing subsystem during CPU hotplug events. The osnoise tracer is used for measuring operating system noise and latency, which is critical for real-time applications. When a CPU is being taken offline, the kernel must coordinate multiple locks to ensure safe execution across different subsystems.

The problematic interaction involves three concurrent tasks that acquire locks in conflicting orders. Task1 acquires interface_lock first, then attempts to acquire cpus_read_lock(). Meanwhile, Task2 (handling the CPU offline event) holds cpus_write_lock() and calls osnoise_cpu_die(), which waits for Task3 to complete via kthread_stop(). Task3, executing within osnoise_sleep(), attempts to acquire interface_lock which is already held by Task1. This creates a circular dependency where no task can proceed, resulting in a deadlock.

Root Cause

The root cause is improper lock ordering in the osnoise subsystem. The cpus_read_lock() and mutex_lock(&interface_lock) calls were executed in an order that violated the kernel's lock hierarchy requirements. When Task1 holds interface_lock and waits for cpus_read_lock(), while the CPU hotplug path holds the CPU write lock and waits for a kernel thread that needs interface_lock, a classic ABBA deadlock pattern emerges.

The fix involves swapping the order of cpus_read_lock() and mutex_lock(&interface_lock) to establish a consistent lock acquisition order across all code paths, ensuring that cpus_read_lock() is always acquired before interface_lock.

Attack Vector

This vulnerability can be triggered when CPU hotplug operations occur while the osnoise tracer is actively running. The attack vector requires:

1. The osnoise tracer must be enabled and running on the system
2. A CPU hotplug event must be initiated (either bringing a CPU offline or through dynamic CPU resource management)
3. The precise timing conditions must align where multiple tasks attempt to acquire locks in the conflicting order

While the exploitation window is narrow and requires specific conditions, systems running real-time workloads with active tracing are most susceptible. Container orchestration platforms and cloud environments that dynamically manage CPU resources may inadvertently trigger this condition during normal operations.

The vulnerability mechanism involves the following lock acquisition sequence that leads to deadlock:

• Task1 acquires interface_lock via mutex_lock() and then attempts cpus_read_lock()
• Task2 holds CPU write lock via cpus_write_lock() during CPU offline processing
• Task3 (osnoise kernel thread) calls osnoise_sleep() which attempts mutex_lock(&interface_lock)
• Circular wait condition established, causing all three tasks to block indefinitely

Detection Methods for CVE-2026-31480

Indicators of Compromise

• System becomes completely unresponsive during CPU hotplug operations
• Kernel lockdep warnings indicating potential lock order violations involving interface_lock and cpus_read_lock
• Hung task warnings in kernel logs related to osnoise or CPU hotplug subsystems
• System requires hard reset after enabling osnoise tracer during CPU frequency scaling or power management events

Detection Strategies

• Enable CONFIG_PROVE_LOCKING (lockdep) in kernel builds to detect lock ordering violations before deadlock occurs
• Monitor /sys/kernel/debug/tracing/trace for abnormal osnoise tracer behavior
• Implement watchdog monitoring to detect system hangs during CPU topology changes
• Review kernel logs for soft lockup or RCU stall warnings associated with tracing subsystems

Monitoring Recommendations

• Deploy system monitoring that alerts on complete loss of heartbeat signals
• Configure hardware watchdog timers to automatically reset systems in case of deadlock
• Monitor CPU hotplug events in conjunction with tracer activation status
• Implement kernel crash dump collection to capture deadlock state for analysis

How to Mitigate CVE-2026-31480

Immediate Actions Required

• Apply the official kernel patches that correct the lock ordering in the osnoise subsystem
• Disable the osnoise tracer on production systems until patches are applied
• Avoid manual CPU hotplug operations on systems running latency-sensitive tracing
• Consider disabling automatic CPU power management features that trigger hotplug events

Patch Information

Multiple patches have been released to address this vulnerability across different kernel stable branches. The fix swaps the order of cpus_read_lock() and mutex_lock(&interface_lock) to prevent the deadlock condition.

Official kernel patches are available:

• Kernel Patch 03474a01
• Kernel Patch 1f988573
• Kernel Patch 7a41d463
• Kernel Patch 7aa095ce
• Kernel Patch cf929c21
• Kernel Patch ef41a85a
• Kernel Patch f278b8eb

Workarounds

• Disable osnoise tracer by writing nop to /sys/kernel/debug/tracing/current_tracer
• Prevent CPU hotplug by setting CPUs to online state and disabling power management
• Use kernel boot parameter maxcpus=N to fix CPU count and avoid runtime hotplug
• Temporarily disable tracing functionality in production environments

# Disable osnoise tracer as a workaround
echo "nop" > /sys/kernel/debug/tracing/current_tracer

# Verify tracer is disabled
cat /sys/kernel/debug/tracing/current_tracer

# Prevent CPU offline operations (set all CPUs online)
for cpu in /sys/devices/system/cpu/cpu*/online; do
    echo 1 > $cpu 2>/dev/null
done