CVE-2026-31762 Overview
CVE-2026-31762 is a resource leak vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem, specifically within the mpu3050 gyroscope driver. The flaw resides in the mpu3050_trigger_probe() function in drivers/iio/gyro/mpu3050-core.c. When iio_trigger_register() fails during driver initialization, the function returns early without releasing the previously requested interrupt handler. The defect was identified by the Smatch static analysis tool, which flagged the unreleased IRQ at line 1124 of the affected source file.
Critical Impact
The leak affects kernel resource accounting on systems using MPU-3050 gyroscope hardware, potentially leading to resource exhaustion under repeated probe failures.
Affected Products
- Linux kernel versions containing the mpu3050-core.c IIO gyroscope driver
- Systems using the InvenSense MPU-3050 gyroscope hardware
- Embedded and mobile platforms relying on the IIO subsystem for sensor management
Discovery Timeline
- 2026-05-01 - CVE-2026-31762 published to NVD
- 2026-05-01 - Last updated in NVD database
Technical Details for CVE-2026-31762
Vulnerability Analysis
The vulnerability is a memory and resource leak [CWE-401] in the Linux kernel IIO gyroscope driver for the InvenSense MPU-3050 sensor. During the trigger probe routine, the driver calls request_threaded_irq() to register an interrupt handler. The probe path then proceeds to call iio_trigger_register() to register the IIO trigger. When the trigger registration fails, the function returns the error directly without invoking free_irq() to release the previously acquired interrupt resource.
This pattern violates Linux kernel cleanup conventions. The standard remediation is a goto-based unwind path that releases acquired resources in reverse order of acquisition. The patch adds the missing cleanup goto so that a failed trigger registration triggers the release of the IRQ handler before the function returns.
The EPSS score for this issue is 0.032%, reflecting low expected exploitation activity. The vulnerability was detected statically by Smatch rather than through runtime exploitation, which is consistent with its nature as a defensive cleanup defect rather than a directly weaponizable flaw.
Root Cause
The root cause is missing error-path cleanup in mpu3050_trigger_probe(). The function acquires an IRQ via request_threaded_irq() but lacks a corresponding free_irq() call along the failure path of iio_trigger_register(). Kernel functions that acquire resources must release them on every error exit, and this requirement was not satisfied.
Attack Vector
The leak occurs during driver probe, which is typically invoked during boot or hotplug events. An attacker would require local control over hardware enumeration or repeated probe-failure conditions to amplify the leak. There is no published evidence of remote exploitation, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is described in prose only, as no public exploit code or proof of concept is available. See the upstream commits referenced below for the precise patch diff.
Detection Methods for CVE-2026-31762
Indicators of Compromise
- Unusual repeated probe failures of the mpu3050 driver in kernel logs (dmesg) referencing iio_trigger_register errors
- Growth in /proc/interrupts entries or orphaned IRQ allocations correlated with driver reload cycles
- Resource accounting anomalies on systems with MPU-3050 sensors after repeated module load or hotplug events
Detection Strategies
- Audit installed kernel versions against the patched commits (3a8e68d, 4216db1, 658d9deb, 8892534) on Linux stable trees
- Run static analysis tooling such as Smatch or Coccinelle against vendor kernel forks to identify unpatched derivatives of mpu3050-core.c
- Track kernel package inventory across embedded fleets to identify devices running pre-patch IIO drivers
Monitoring Recommendations
- Monitor kernel logs for repeated mpu3050_trigger_probe failures and IIO trigger registration errors
- Track IRQ allocation counts over time on long-running systems with MPU-3050 hardware
- Include kernel version inventory checks in routine vulnerability scans for Linux fleet devices
How to Mitigate CVE-2026-31762
Immediate Actions Required
- Identify systems running affected Linux kernel versions that include the unpatched mpu3050-core.c driver
- Apply the upstream stable kernel patches referenced in the NVD entry to all affected hosts
- Where patching is not immediately possible, unload or blacklist the mpu3050 module on systems that do not require gyroscope functionality
Patch Information
The Linux kernel maintainers resolved the issue by adding a cleanup goto in mpu3050_trigger_probe() so the IRQ acquired via request_threaded_irq() is released when iio_trigger_register() fails. The fix is distributed across multiple stable branches via commits 3a8e68d, 4216db1, 658d9deb, 889253494ec7, 8f237c4, b52fd16, beb2309, and e66215f. Administrators should rebuild and redeploy kernels containing these fixes.
Workarounds
- Blacklist the mpu3050 kernel module on systems that do not depend on the InvenSense MPU-3050 gyroscope
- Restrict local hardware enumeration access to limit repeated probe-failure scenarios
- Reboot affected systems periodically as a temporary measure to reset leaked IRQ resources until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
