CVE-2026-31741: Linux Kernel Privilege Escalation Flaw

CVE-2026-31741 Overview

CVE-2026-31741 affects the Linux kernel counter subsystem, specifically the Renesas RZ MTU3 counter driver (rz-mtu3-cnt). The flaw allows local users to cause a Runtime Power Management (PM) usage count underflow by writing the same value to the sysfs enable file multiple times. Each write increments or decrements the Runtime PM counter without verifying the cached count_is_enabled state. Repeated writes trigger kernel warnings, cause hardware register access while clocks are off, and can stop a Pulse Width Modulation (PWM) operation when the counter is not the owner of the underlying MTU3 channel.

Critical Impact
Local users can underflow the Runtime PM usage counter, trigger hardware register access with clocks disabled, and disrupt active PWM operations on Renesas RZ platforms.

Affected Products

Linux kernel versions containing the rz-mtu3-cnt counter driver prior to the fix
Renesas RZ-series platforms using the MTU3 counter subsystem
Stable kernel branches referenced by commits 67c3f99b, 885aa739, ced8b484, e07237df, and f5f6f06d

Discovery Timeline

2026-05-01 - CVE-2026-31741 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31741

Vulnerability Analysis

The vulnerability resides in the Linux kernel counter subsystem driver rz-mtu3-cnt, which manages the Renesas RZ MTU3 hardware counter. The driver exposes an enable file through sysfs that controls whether counting is active on a given channel. Each write to this file unconditionally increments or decrements the Runtime PM usage counter without checking whether the channel state is already changing in that direction.

When a user writes 0 to the enable file repeatedly, the Runtime PM usage count decrements past zero. The kernel emits the message rz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!. The driver then proceeds to call rz_mtu3_terminate_counter(), accessing hardware registers while clocks have already been gated off.

Repeated writes of 1 produce the inverse problem. The Runtime PM count climbs without a matching enabled state, requiring an equal number of 0 writes to balance the reference count. A separate condition occurs when a user writes 0 while a PWM operation is active. The counter driver stops the PWM even though it does not own the MTU3 channel at that moment.

Root Cause

The driver lacks a state guard against duplicate enable transitions. The fix introduces a check against the cached count_is_enabled value, returning early when the user attempts to set the current state. This prevents reference count drift and unauthorized channel termination.

Attack Vector

Exploitation requires local access with permission to write to the sysfs counter enable file. A user with appropriate filesystem permissions repeatedly writes the same value to trigger the underflow or to stop a PWM owned by another subsystem. Remote exploitation is not applicable.

// Conceptual condition introduced by the patch
// Exit early when the requested state matches the cached state
if (priv->count_is_enabled == enable)
    return 0;

Detection Methods for CVE-2026-31741

Indicators of Compromise

Kernel log entries containing rz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!
Repeated writes to /sys/bus/counter/devices/counter*/count*/enable from a single process
Unexpected termination of PWM output on Renesas RZ MTU3 channels
Hardware register access warnings when MTU3 clocks are gated

Detection Strategies

Monitor dmesg and /var/log/kern.log for Runtime PM underflow messages tied to rz-mtu3-counter
Audit processes writing to counter sysfs nodes using auditd rules on /sys/bus/counter/
Track abrupt PWM state changes through hardware-aware telemetry on embedded RZ platforms

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline for correlation
Alert on any occurrence of Runtime PM usage count underflow strings tied to counter drivers
Baseline expected sysfs writers and flag deviations from authorized control processes

How to Mitigate CVE-2026-31741

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 67c3f99b, 885aa739, ced8b484, e07237df, and f5f6f06d
Restrict write permissions on counter sysfs enable files to trusted system services
Inventory Renesas RZ deployments using the rz-mtu3-cnt driver to confirm patch coverage

Patch Information

The fix is committed to the Linux stable tree across multiple branches. See the Kernel Stable Commit 67c3f99b, Kernel Stable Commit 885aa739, Kernel Stable Commit ced8b484, Kernel Stable Commit e07237df, and Kernel Stable Commit f5f6f06d. The patch adds an early return when the user-supplied enable value matches the cached count_is_enabled state.

Workarounds

Limit access to /sys/bus/counter/ interfaces using mount options or udev rules until patches are deployed
Wrap counter control in a privileged helper that enforces idempotent state transitions
Disable the rz-mtu3-cnt driver on systems that do not require MTU3 counter functionality

bash

# Restrict sysfs counter enable file to root only via udev
# /etc/udev/rules.d/90-rz-mtu3-counter.rules
SUBSYSTEM=="counter", KERNEL=="counter*", ACTION=="add", RUN+="/bin/chmod 600 /sys/bus/counter/devices/%k/count0/enable"