CVE-2026-31550: Linux Kernel BCM2835 Power DoS Vulnerability

CVE-2026-31550 Overview

CVE-2026-31550 is a Denial of Service vulnerability in the Linux kernel's BCM2835 power domain driver. The bcm2835_asb_control() function uses a tight polling loop to wait for the ASB (AXI Sideband Manager) bridge to acknowledge a request. During intensive workloads, this handshake intermittently fails for V3D's master ASB on BCM2711, resulting in "Failed to disable ASB master for v3d" errors during runtime PM suspend. As a consequence, the failed power-off leaves V3D in a broken state, leading to bus faults or system hangs on later accesses.

Critical Impact
Failed V3D power management operations can leave the graphics subsystem in an inconsistent state, causing bus faults or complete system hangs on BCM2711-based systems including Raspberry Pi 4.

Affected Products

Linux Kernel (multiple versions)
Linux Kernel 5.1
Linux Kernel 7.0 RC1-RC7

Discovery Timeline

2026-04-24 - CVE-2026-31550 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31550

Vulnerability Analysis

This vulnerability exists in the pmdomain/bcm/bcm2835-power driver, specifically within the bcm2835_asb_control() function. The function implements a polling loop that waits for the ASB bridge to acknowledge power state transition requests. The original implementation used a 1 microsecond timeout for this polling operation, which proves insufficient during high system load conditions.

When the V3D GPU subsystem on BCM2711 SoCs (used in Raspberry Pi 4 and similar devices) attempts runtime power management suspend operations, the ASB master handshake can fail to complete within the allocated timeout window. This race condition becomes more prevalent under intensive workloads where CPU scheduling delays can extend the time between polling iterations.

The failed handshake leaves the V3D subsystem in an undefined power state. Subsequent attempts to access V3D resources when it's in this broken state result in bus faults or, in severe cases, complete system hangs requiring a hard reset.

Root Cause

The root cause is an insufficient timeout value in the bcm2835_asb_control() function's polling loop. The original 1 microsecond timeout does not account for system load variations that can delay the ASB bridge's acknowledgment response. Additionally, the open-coded ktime_get_ns() and cpu_relax() polling implementation lacks the robustness of kernel-standard polling macros.

Attack Vector

This vulnerability requires local access and manifests as a race condition during power management operations. While not directly exploitable for code execution, a local attacker or faulty application could trigger the condition by:

Creating intensive CPU or GPU workloads to increase system load
Forcing rapid V3D runtime PM suspend/resume cycles
Exploiting the timing window where ASB handshake fails

The attack vector is local (AV:L) with low complexity, requiring low privileges but no user interaction. The impact is limited to availability, causing system instability or hangs.

The vulnerability affects the power domain transition flow in the BCM2835 power driver. When bcm2835_asb_control() times out waiting for the ASB bridge acknowledgment, it returns an error that propagates up the power management stack, leaving V3D in an inconsistent state. The fix increases the polling timeout from 1us to 5us and replaces the manual polling loop with readl_poll_timeout_atomic() for more reliable timing behavior.

Detection Methods for CVE-2026-31550

Indicators of Compromise

Kernel log messages showing "Failed to disable ASB master for v3d" errors
System hangs or freezes when V3D GPU workloads complete
Bus fault messages in dmesg related to V3D memory access
Unexplained system crashes on Raspberry Pi 4 or other BCM2711-based devices under GPU load

Detection Strategies

Monitor kernel logs for ASB-related error messages using dmesg | grep -i "asb\|v3d"
Implement watchdog monitoring for system responsiveness during GPU-intensive operations
Use SentinelOne's behavioral analysis to detect unusual system hang patterns on affected hardware

Monitoring Recommendations

Enable verbose kernel logging for the BCM2835 power domain driver
Set up automated alerting for V3D-related kernel error messages
Monitor system uptime and unexpected reboot patterns on BCM2711-based systems

How to Mitigate CVE-2026-31550

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix
On Raspberry Pi 4 systems, consider disabling V3D runtime PM temporarily if updates cannot be immediately applied
Monitor systems for signs of the vulnerability being triggered

Patch Information

Multiple patches have been released to address this vulnerability. The fix increases the ASB control polling timeout from 1us to 5us and replaces the open-coded polling loop with readl_poll_timeout_atomic(). Relevant kernel patches are available from the official Linux kernel git repository:

Workarounds

Disable V3D runtime power management by adding v3d.runpm=0 to kernel boot parameters
Reduce GPU workload intensity on affected systems to minimize the probability of triggering the race condition
If running virtualized workloads, ensure adequate CPU resources are allocated to prevent scheduling delays during power transitions

bash

# Disable V3D runtime PM as a temporary workaround
# Add to /boot/cmdline.txt on Raspberry Pi systems
v3d.runpm=0

# Or load the v3d module with runtime PM disabled
modprobe v3d runpm=0