CVE-2026-31763: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31763 Overview

CVE-2026-31763 affects the Linux kernel's Industrial I/O (IIO) subsystem, specifically the mpu3050 gyroscope driver. The vulnerability resides in the IRQ teardown path, where free_irq() is invoked with the wrong handler argument. The driver registers its interrupt handler against mpu3050->trig, but the cleanup code passes mpu3050 instead. This mismatch prevents proper release of interrupt resources during driver teardown. The fix corrects the handler reference passed to free_irq() so the IRQ is released using the same cookie used at registration.

Critical Impact

Improper IRQ teardown in the mpu3050 driver can leave interrupt handlers registered after device removal, leading to resource leaks or undefined behavior on subsequent driver loads.

Affected Products

• Linux kernel builds including the iiompu3050 gyroscope driver
• Distributions shipping pre-patch stable kernel branches referenced in upstream commits
• Embedded and IoT systems exposing the InvenSense MPU-3050 sensor through IIO

Discovery Timeline

• 2026-05-01 - CVE-2026-31763 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31763

Vulnerability Analysis

The mpu3050 driver in drivers/iio/gyro/ registers a threaded interrupt handler tied to the IIO trigger structure stored at mpu3050->trig. The Linux kernel's request_irq() and free_irq() APIs require that the dev_id cookie passed to free_irq() match the cookie used at registration. The driver violated this contract by calling free_irq() with the parent mpu3050 pointer rather than mpu3050->trig. Because the kernel uses the cookie to locate the correct IRQ action entry, the release request fails to identify the registered handler. This leaves stale interrupt registrations referencing freed driver state when the device unbinds.

Root Cause

The root cause is a developer error in the driver teardown logic — passing the wrong pointer as the dev_id argument to free_irq(). This is a kernel driver resource management defect rather than a memory-safety primitive. The flaw falls under file system and OS issues, specifically a kernel driver vulnerability affecting interrupt lifecycle management.

Attack Vector

Exploitation requires local access to a system using the mpu3050 driver, typically via direct hardware presence on embedded platforms. An attacker or unprivileged trigger that causes the driver to unbind and rebind can leave interrupt state inconsistent. The practical effect is a denial-of-service condition or instability tied to module reload cycles. There is no public exploit, and the EPSS probability is low. See the upstream patches at the Kernel Git Commit 11f7cd96 and Kernel Git Commit a09171d3 for the corrective changes.

No verified exploit code is available. The vulnerability is described in prose based on upstream commit messages.

Detection Methods for CVE-2026-31763

Indicators of Compromise

• Kernel log entries referencing free_irq warnings or Trying to free already-free IRQ messages tied to the mpu3050 driver
• Unexpected kernel oops or warnings during unbind of IIO gyroscope devices
• Persistent IRQ entries in /proc/interrupts after the mpu3050 module is removed

Detection Strategies

• Audit running kernel versions against the fixed commits listed in the upstream advisory to identify unpatched hosts
• Monitor dmesg output for warnings emitted by __free_irq() when handler cookies do not match
• Inventory embedded and IoT assets that expose the InvenSense MPU-3050 sensor and verify driver provenance

Monitoring Recommendations

• Forward kernel ring buffer logs to a centralized logging or SIEM platform for correlation across fleet hosts
• Track kernel package versions through endpoint configuration management to flag systems running pre-patch builds
• Alert on repeated module load and unload events for iio drivers, which can indicate triggering of the defect

How to Mitigate CVE-2026-31763

Immediate Actions Required

• Apply the upstream stable kernel patches that correct the free_irq() argument in drivers/iio/gyro/mpu3050
• Rebuild and redeploy custom kernels that vendor the mpu3050 driver from affected source trees
• For systems that do not require the mpu3050 sensor, blacklist the module to remove exposure

Patch Information

The fix was committed across multiple stable kernel branches. Reference the upstream commits: Kernel Git Commit 11f7cd96, Kernel Git Commit 2821f7b6, Kernel Git Commit 8001b42f, Kernel Git Commit 8631e755, Kernel Git Commit a09171d3, Kernel Git Commit ac123339, Kernel Git Commit edb11a1a, and Kernel Git Commit fdbe4b52. The change replaces the mpu3050 cookie with mpu3050->trig in the free_irq() call to match the registration site.

Workarounds

• Avoid unbinding or unloading the mpu3050 driver on production systems until patched kernels are deployed
• Blacklist the mpu3050 module on hosts that do not require gyroscope telemetry to eliminate the affected code path
• Restrict local access on embedded devices to reduce the population able to trigger driver lifecycle events

# Blacklist the affected driver until a patched kernel is installed
echo "blacklist mpu3050" | sudo tee /etc/modprobe.d/blacklist-mpu3050.conf
sudo update-initramfs -u