CVE-2026-31731: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31731 Overview

CVE-2026-31731 is a use-after-free vulnerability in the Linux kernel's thermal subsystem [CWE-416]. The flaw resides in the thermal core, where thermal_zone_pm_complete() and thermal_zone_device_resume() re-initialize the poll_queue delayed work for a thermal zone. This re-initialization causes cancel_delayed_work_sync() in thermal_zone_device_unregister() to miss already running work items, allowing the thermal zone object to be freed while work continues to execute. An attacker with local access can trigger races between thermal zone removal and system resume operations to corrupt kernel memory.

Critical Impact
Local attackers can trigger a kernel use-after-free condition during suspend/resume cycles, leading to memory corruption, privilege escalation, or denial of service.

Affected Products

Linux Kernel 7.0-rc1 through 7.0-rc6
Linux Kernel stable branches affected per upstream commits
Distributions shipping unpatched kernels with the thermal core subsystem

Discovery Timeline

2026-05-01 - CVE-2026-31731 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-31731

Vulnerability Analysis

The vulnerability arises from a race between thermal zone unregistration and the power management resume path. The kernel uses delayed work items queued on poll_queue to perform periodic thermal monitoring. During system resume, both thermal_zone_pm_complete() and thermal_zone_device_resume() re-initialize this delayed work structure. When thermal_zone_device_unregister() runs concurrently, the cancel_delayed_work_sync() call may operate on a re-initialized work item and miss in-flight executions.

Two distinct failure paths exist. In the first, a work item is already running when thermal_pm_notify_complete() invokes thermal_zone_pm_complete() for the same zone. The running work continues past the unregister and accesses freed memory. In the second, thermal_zone_device_resume() queued by thermal_pm_notify_complete() executes after thermal_zone_exit() returns. It re-initializes the delayed work before the cancellation completes, and the new work then runs against a freed thermal zone object.

Root Cause

The root cause is non-atomic coordination between the PM notifier callbacks and the unregister path. Re-initializing the poll_queue after teardown begins invalidates the synchronization guarantees that cancel_delayed_work_sync() provides, leaving freed struct thermal_zone_device memory accessible to scheduled work items.

Attack Vector

Exploitation requires local access with low privileges. An attacker triggers system suspend and resume operations while a thermal zone is being removed, racing the PM notifier path against thermal_zone_device_unregister(). Successful exploitation yields kernel-level use-after-free with potential for arbitrary kernel memory corruption and privilege escalation to root.

No public proof-of-concept code or in-the-wild exploitation has been reported. The vulnerability mechanism is documented in the upstream commit messages referenced in the Linux kernel stable tree.

Detection Methods for CVE-2026-31731

Indicators of Compromise

Kernel oops or panic messages referencing thermal_zone_device, poll_queue, or thermal_zone_device_check near suspend/resume events
KASAN reports flagging use-after-free in the drivers/thermal/thermal_core.c code path
Unexpected kernel crashes correlated with thermal driver module unload or hotplug operations during system resume

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch use-after-free conditions in the thermal subsystem during fuzzing or stress testing
Monitor dmesg and persistent kernel logs for warnings tied to cancel_delayed_work_sync or workqueue corruption
Audit kernel build versions across the fleet to identify hosts running affected 7.0-rc series or unpatched stable kernels

Monitoring Recommendations

Collect kernel crash dumps via kdump and inspect for stack traces involving thermal core functions
Track suspend/resume cycle counts on shared multi-tenant systems where untrusted local users can influence PM events
Alert on repeated kernel panics from systems with similar hardware profiles, which may indicate exploitation attempts

How to Mitigate CVE-2026-31731

Immediate Actions Required

Apply the upstream patches from the Linux kernel stable tree referenced in the vendor advisory commits
Update to a distribution kernel package that incorporates the thermal core race-condition fixes
Restrict local user access to suspend/resume controls on multi-user systems where feasible

Patch Information

The fix moves the cancel_delayed_work() call from thermal_zone_pm_complete() to thermal_zone_pm_prepare() to block new work from entering the queue. It introduces a dedicated workqueue for thermal events and flushes that workqueue after thermal_pm_notify_prepare() returns. A tz->state check is added to thermal_zone_device_resume() to prevent re-initialization of poll_queue when a thermal zone is being torn down. The corrective commits are: 1a6d2b001eb7, 2dbe93f344f1, 45b859b07282, and c4593f1654f7.

Workarounds

Disable system suspend on affected kernels where the patch cannot be applied immediately by masking suspend.target and hibernate.target via systemctl
Limit access to PM sysfs and ACPI interfaces such as /sys/power/state to root only
Avoid dynamic loading or unloading of thermal driver modules on production systems running affected kernel versions

bash

# Verify running kernel version against affected releases
uname -r

# Restrict access to power-state controls
chmod 600 /sys/power/state

# Mask suspend targets as a temporary workaround
sudo systemctl mask suspend.target hibernate.target hybrid-sleep.target