CVE-2026-31655: Linux Kernel DOS Vulnerability

CVE-2026-31655 Overview

CVE-2026-31655 is a vulnerability in the Linux kernel's power management domain controller (pmdomain) for the i.MX8MP block controller. The vulnerability exists in the imx8mp-blk-ctrl driver where the NOC_HDCP clock is not kept enabled, leading to a potential system hang when the NoC ADB400 port power down handshake occurs. This affects embedded systems and devices utilizing NXP i.MX8MP processors.

Critical Impact
Local attackers with low privileges can trigger a denial of service condition causing system hangs on affected Linux systems running on i.MX8MP hardware platforms.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 6.1
Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

2026-04-24 - CVE CVE-2026-31655 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31655

Vulnerability Analysis

This vulnerability resides in the imx8mp-blk-ctrl power domain driver within the Linux kernel. The core issue is that the NOC_HDCP (Network-on-Chip High-bandwidth Digital Content Protection) clock can be disabled during normal system operation. When the clock is disabled and the NoC ADB400 port attempts to perform a power down handshake, the handshake fails to complete, resulting in a system hang.

The ADB400 (AMBA Domain Bridge) is responsible for managing clock domain crossings in the i.MX8MP SoC. The power down handshake requires the NOC_HDCP clock to be active; without it, the handshake enters an indefinite wait state, causing the entire system to become unresponsive.

Root Cause

The root cause is improper clock management in the imx8mp-blk-ctrl driver. The NOC_HDCP clock was subject to standard power management policies that allowed it to be gated (disabled) when not explicitly in use. However, this clock is required for critical inter-domain communication during power state transitions. The fix ensures the NOC_HDCP clock remains always enabled, preventing the race condition that leads to the handshake failure.

Attack Vector

This is a local attack vector that requires low privileges on the affected system. An attacker with local access could potentially trigger power state transitions that exploit this vulnerability, causing a denial of service through system hang. The vulnerability does not allow for code execution or data disclosure—it is strictly an availability impact affecting system stability.

The attack surface is limited to systems running the affected Linux kernel versions on NXP i.MX8MP hardware platforms, which are commonly used in embedded systems, industrial applications, and multimedia devices.

Detection Methods for CVE-2026-31655

Indicators of Compromise

Unexplained system hangs on i.MX8MP-based devices during power state transitions
Kernel log entries indicating ADB400 handshake timeouts or failures
System unresponsiveness following suspend/resume or display power management events

Detection Strategies

Monitor kernel logs for messages related to imx8mp-blk-ctrl, pmdomain, or ADB400 handshake failures
Implement watchdog monitoring to detect and alert on system hang conditions
Audit running kernel versions against patched releases using uname -r

Monitoring Recommendations

Enable kernel debug logging for power management subsystems on affected hardware
Implement automated kernel version checking across embedded device fleets
Configure hardware watchdog timers to automatically recover from hang conditions

How to Mitigate CVE-2026-31655

Immediate Actions Required

Update the Linux kernel to a patched version containing the NOC_HDCP clock fix
Review deployed i.MX8MP-based systems for vulnerable kernel versions
Prioritize patching on production embedded systems where availability is critical

Patch Information

The Linux kernel maintainers have released patches across multiple stable branches. The fix ensures the NOC_HDCP clock remains always enabled, preventing the power down handshake failure. Patches are available through the following kernel commits:

Workarounds

Disable automatic power management for the HDMI subsystem on affected devices as a temporary measure
Configure systems to avoid power state transitions that trigger the ADB400 handshake until patching is complete
Implement hardware watchdog timers to automatically reboot systems in case of hang conditions

bash

# Check current kernel version on affected systems
uname -r

# Verify if the imx8mp-blk-ctrl module is loaded
lsmod | grep imx8mp

# Review kernel logs for related power management issues
dmesg | grep -i "imx8mp\|blk-ctrl\|noc\|adb400"