CVE-2026-31567: Linux Kernel GFP Mask Warning Vulnerability

CVE-2026-31567 Overview

CVE-2026-31567 is a medium-severity vulnerability in the Linux kernel's power management (PM) sleep subsystem. The flaw stems from a spurious WARN_ON() in pm_restore_gfp_mask() introduced by commit 35e4a69b2003f ("PM: sleep: Allow pm_restrict_gfp_mask() stacking"). Defensive hibernation paths that call pm_restore_gfp_mask() when saved_gfp_count == 0 now trigger false warnings. On systems configured with panic_on_warn, this reachable assertion can crash the kernel, producing a local denial-of-service condition. The issue is classified under [CWE-617: Reachable Assertion].

Critical Impact
Local low-privileged users invoking hibernation ioctls through the uswsusp interface can trigger spurious kernel warnings, causing denial-of-service on panic_on_warn systems.

Affected Products

Linux Kernel 6.18
Linux Kernel 7.0 release candidates (rc1 through rc7)
Stable trees prior to fix commits 3025ca5daa9d, a8d51efb5929, and f19d1323aa3d

Discovery Timeline

2026-04-24 - CVE-2026-31567 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31567

Vulnerability Analysis

The Linux kernel power management subsystem restricts the GFP (Get Free Pages) mask during system sleep operations to prevent memory allocations that could deadlock the hibernation or suspend pipeline. Commit 35e4a69b2003f reworked pm_restrict_gfp_mask() to support stacking via a saved_gfp_count refcount. The companion pm_restore_gfp_mask() function decrements this counter and emits a WARN_ON() when called while the counter is already zero.

Several hibernation paths invoke pm_restore_gfp_mask() defensively without knowing whether the mask was previously restricted. The userspace software suspend (uswsusp) interface calls it from SNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, and snapshot_release(). Before the stacking change these calls were silent no-ops. After the change they emit a kernel warning with full stack trace each time the GFP mask is already unrestricted.

Root Cause

The root cause is an overly aggressive invariant check. The new refcount-based design treats a zero saved_gfp_count on entry as a programming bug, but legitimate defensive callers can reach this state during normal operation. The check itself is correct, but wrapping it in WARN_ON() produces false positives on legitimate code paths.

Attack Vector

A local user with permission to open /dev/snapshot (typically requiring CAP_SYS_ADMIN) can issue the affected ioctls to trigger the warning repeatedly. On kernels built with CONFIG_PANIC_ON_OOPS or booted with panic_on_warn=1, each warning escalates to a kernel panic. Even without panic-on-warn, repeated warnings can flood kernel logs and consume disk space, degrading system availability.

The vulnerability requires local access and low privileges. No user interaction is required beyond invoking the standard hibernation ioctls. The impact is limited to availability; confidentiality and integrity are not affected.

Detection Methods for CVE-2026-31567

Indicators of Compromise

Kernel log entries containing WARN_ON stack traces referencing pm_restore_gfp_mask in kernel/power/main.c
Unexpected kernel panics on systems with panic_on_warn enabled following hibernation or snapshot operations
Repeated invocations of SNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, or snapshot_release ioctls from unprivileged-looking processes

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for pm_restore_gfp_mask warnings and rate-limit alerts on repeated occurrences
Audit access to /dev/snapshot using auditd rules to track which processes invoke hibernation ioctls
Correlate kernel oops events with preceding ioctl activity to identify intentional triggering

Monitoring Recommendations

Enable kernel audit logging for open and ioctl syscalls targeting /dev/snapshot
Forward kernel ring buffer messages to a centralized log aggregation platform for anomaly detection
Alert on any kernel panic events on production hosts, particularly those tied to power management subsystems

How to Mitigate CVE-2026-31567

Immediate Actions Required

Apply the upstream kernel patches from commits 3025ca5daa9d682b629c0c958b538e41deeb559d, a8d51efb5929ae308895455a3e496b5eca2cd143, and f19d1323aa3dd7ead469aef47d9085f8939565d9
Restrict access to /dev/snapshot to trusted administrative users only by tightening device node permissions
Disable panic_on_warn on production systems where uptime is critical until patches are deployed

Patch Information

The fix removes the WARN_ON() wrapper from the !saved_gfp_count check while retaining the conditional check itself. This preserves the protective behavior without producing false warnings on defensive call paths. Patches are available in the mainline kernel and have been backported to relevant stable branches. Refer to the Kernel Git Commit Fix, Kernel Git Commit Update, and Kernel Git Commit Change for backport details.

Workarounds

Remove panic_on_warn from kernel boot parameters and sysctl configuration to prevent warning escalation to panic
Restrict CAP_SYS_ADMIN capability and tighten permissions on /dev/snapshot to limit which users can invoke hibernation ioctls
Disable the uswsusp userspace hibernation interface on servers that do not require hibernation functionality

bash

# Configuration example: disable panic_on_warn at runtime
sysctl -w kernel.panic_on_warn=0

# Restrict access to the snapshot device
chmod 600 /dev/snapshot
chown root:root /dev/snapshot

# Verify kernel version after patching
uname -r