CVE-2026-31667 (GCVE-0-2026-31667)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:45 – Updated: 2026-08-05 12:24
VLAI
Title
Input: uinput - fix circular locking dependency with ff-core
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - fix circular locking dependency with ff-core A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for example, playing ELDEN RING under Wine with a Flydigi Vader 5 controller): ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex The cycle is caused by four lock acquisition paths: 1. ff upload: input_ff_upload() holds ff->mutex and calls uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), which acquires udev->mutex. 2. device create: uinput_ioctl_handler() holds udev->mutex and calls uinput_create_device() -> input_register_device(), which acquires input_mutex. 3. device register: input_register_device() holds input_mutex and calls kbd_connect() -> input_register_handle(), which acquires dev->mutex. 4. evdev release: evdev_release() calls input_flush_device() under dev->mutex, which calls input_ff_flush() acquiring ff->mutex. Fix this by introducing a new state_lock spinlock to protect udev->state and udev->dev access in uinput_request_send() instead of acquiring udev->mutex. The function only needs to atomically check device state and queue an input event into the ring buffer via uinput_dev_event() -- both operations are safe under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in the lock ordering and cannot form cycles with mutexes. To keep state transitions visible to uinput_request_send(), protect writes to udev->state in uinput_create_device() and uinput_destroy_device() with the same state_lock spinlock. Additionally, move init_completion(&request->done) from uinput_request_send() to uinput_request_submit() before uinput_request_reserve_slot(). Once the slot is allocated, uinput_flush_requests() may call complete() on it at any time from the destroy path, so the completion must be initialised before the request becomes visible. Lock ordering after the fix: ff->mutex -> state_lock (spinlock, leaf) udev->mutex -> state_lock (spinlock, leaf) udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ff462551235d8d7d843a005950bc90924fcedede , < 71a9729f412e2c692a35c542e14b706fb342927f (git)
Affected: ff462551235d8d7d843a005950bc90924fcedede , < 271ee71a1917b89f6d73ec82dd091c33d92ee617 (git)
Affected: ff462551235d8d7d843a005950bc90924fcedede , < 974f7b138c3a96dd5cd53d1b33409cd7b2229dc6 (git)
Affected: ff462551235d8d7d843a005950bc90924fcedede , < 546c18a14924eb521fe168d916d7ce28f1e13c1d (git)
Affected: ff462551235d8d7d843a005950bc90924fcedede , < a3d6c9c053c9c605651508569230ead633b13f76 (git)
Affected: ff462551235d8d7d843a005950bc90924fcedede , < 1e09dfbb4f5d20ee111f92325a00f85778a5f328 (git)
Affected: ff462551235d8d7d843a005950bc90924fcedede , < 1534661043c434b81cfde26b97a2fb2460329cf0 (git)
Affected: ff462551235d8d7d843a005950bc90924fcedede , < 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.19
Unaffected: 0 , < 2.6.19 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.169 , ≤ 6.1.* (semver)
Unaffected: 6.6.135 , ≤ 6.6.* (semver)
Unaffected: 6.12.82 , ≤ 6.12.* (semver)
Unaffected: 6.18.23 , ≤ 6.18.* (semver)
Unaffected: 6.19.13 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/misc/uinput.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "71a9729f412e2c692a35c542e14b706fb342927f",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            },
            {
              "lessThan": "271ee71a1917b89f6d73ec82dd091c33d92ee617",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            },
            {
              "lessThan": "974f7b138c3a96dd5cd53d1b33409cd7b2229dc6",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            },
            {
              "lessThan": "546c18a14924eb521fe168d916d7ce28f1e13c1d",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            },
            {
              "lessThan": "a3d6c9c053c9c605651508569230ead633b13f76",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            },
            {
              "lessThan": "1e09dfbb4f5d20ee111f92325a00f85778a5f328",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            },
            {
              "lessThan": "1534661043c434b81cfde26b97a2fb2460329cf0",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            },
            {
              "lessThan": "4cda78d6f8bf2b700529f2fbccb994c3e826d7c2",
              "status": "affected",
              "version": "ff462551235d8d7d843a005950bc90924fcedede",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/misc/uinput.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n  ff-\u003emutex -\u003e udev-\u003emutex -\u003e input_mutex -\u003e dev-\u003emutex -\u003e ff-\u003emutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff-\u003emutex and calls\n   uinput_dev_upload_effect() -\u003e uinput_request_submit() -\u003e\n   uinput_request_send(), which acquires udev-\u003emutex.\n\n2. device create: uinput_ioctl_handler() holds udev-\u003emutex and calls\n   uinput_create_device() -\u003e input_register_device(), which acquires\n   input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n   calls kbd_connect() -\u003e input_register_handle(), which acquires\n   dev-\u003emutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n   dev-\u003emutex, which calls input_ff_flush() acquiring ff-\u003emutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev-\u003estate and udev-\u003edev access in uinput_request_send() instead of\nacquiring udev-\u003emutex.  The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep).  This\nbreaks the ff-\u003emutex -\u003e udev-\u003emutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev-\u003estate in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(\u0026request-\u003edone) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot().  Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n  ff-\u003emutex -\u003e state_lock (spinlock, leaf)\n  udev-\u003emutex -\u003e state_lock (spinlock, leaf)\n  udev-\u003emutex -\u003e input_mutex -\u003e dev-\u003emutex -\u003e ff-\u003emutex (no back-edge)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local uinput and evdev character-device operations, including uinput setup/destruction ioctls and evdev force-feedback upload ioctls. There is no network, adjacent, or physical packet/device insertion path.\nAC:L - The attacker can control the relevant operations by creating a force-feedback uinput device and racing/concurrently invoking force-feedback upload and device teardown paths. Because both sides of the race are attacker-driven, the complexity is Low.\nPR:L - The kernel code does not require CAP_SYS_ADMIN or another capability, but the attacker needs local access to the uinput/evdev device nodes. In the most severe reasonable deployments these are reachable by an unprivileged local user or input/session-privileged account, so this is Low rather than High.\nUI:N - No victim action is required once the attacker has local device-node access. The attacker can issue the needed ioctls and close/release operations directly.\nS:U - The impact remains within the local kernel/input subsystem security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The fix includes moving completion initialization before publishing the request slot, because teardown could otherwise call complete() on an uninitialized stack completion. That is kernel memory corruption, and under the required higher-severity rule it is treated as potentially enabling kernel memory disclosure.\nI:H - Calling complete() on an uninitialized completion can operate on corrupted spinlock/list state and kernel pointers, not merely return an error. Under the required higher-severity rule, this memory corruption is scored as potentially enabling high-integrity kernel compromise.\nA:H - The documented locking cycle can deadlock, and the uninitialized completion race is consistent with prior uinput force-feedback crashes involving bad spinlock state. Either outcome can hang or crash the kernel, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:17.157Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f"
        },
        {
          "url": "https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617"
        },
        {
          "url": "https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328"
        },
        {
          "url": "https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2"
        }
      ],
      "title": "Input: uinput - fix circular locking dependency with ff-core",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31667",
    "datePublished": "2026-04-24T14:45:15.937Z",
    "dateReserved": "2026-03-09T15:48:24.129Z",
    "dateUpdated": "2026-08-05T12:24:17.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31667",
      "date": "2026-08-06",
      "epss": "0.00096",
      "percentile": "0.00831"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-01T14:39:19.000Z",
      "cve": "CVE-2026-31667",
      "id": "msrc_CVE-2026-31667",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Input: uinput - fix circular locking dependency with ff-core",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31667.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31667\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-24T15:16:46.390\",\"lastModified\":\"2026-06-17T10:34:11.923\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: uinput - fix circular locking dependency with ff-core\\n\\nA lockdep circular locking dependency warning can be triggered\\nreproducibly when using a force-feedback gamepad with uinput (for\\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\\ncontroller):\\n\\n  ff-\u003emutex -\u003e udev-\u003emutex -\u003e input_mutex -\u003e dev-\u003emutex -\u003e ff-\u003emutex\\n\\nThe cycle is caused by four lock acquisition paths:\\n\\n1. ff upload: input_ff_upload() holds ff-\u003emutex and calls\\n   uinput_dev_upload_effect() -\u003e uinput_request_submit() -\u003e\\n   uinput_request_send(), which acquires udev-\u003emutex.\\n\\n2. device create: uinput_ioctl_handler() holds udev-\u003emutex and calls\\n   uinput_create_device() -\u003e input_register_device(), which acquires\\n   input_mutex.\\n\\n3. device register: input_register_device() holds input_mutex and\\n   calls kbd_connect() -\u003e input_register_handle(), which acquires\\n   dev-\u003emutex.\\n\\n4. evdev release: evdev_release() calls input_flush_device() under\\n   dev-\u003emutex, which calls input_ff_flush() acquiring ff-\u003emutex.\\n\\nFix this by introducing a new state_lock spinlock to protect\\nudev-\u003estate and udev-\u003edev access in uinput_request_send() instead of\\nacquiring udev-\u003emutex.  The function only needs to atomically check\\ndevice state and queue an input event into the ring buffer via\\nuinput_dev_event() -- both operations are safe under a spinlock\\n(ktime_get_ts64() and wake_up_interruptible() do not sleep).  This\\nbreaks the ff-\u003emutex -\u003e udev-\u003emutex link since a spinlock is a leaf in\\nthe lock ordering and cannot form cycles with mutexes.\\n\\nTo keep state transitions visible to uinput_request_send(), protect\\nwrites to udev-\u003estate in uinput_create_device() and\\nuinput_destroy_device() with the same state_lock spinlock.\\n\\nAdditionally, move init_completion(\u0026request-\u003edone) from\\nuinput_request_send() to uinput_request_submit() before\\nuinput_request_reserve_slot().  Once the slot is allocated,\\nuinput_flush_requests() may call complete() on it at any time from\\nthe destroy path, so the completion must be initialised before the\\nrequest becomes visible.\\n\\nLock ordering after the fix:\\n\\n  ff-\u003emutex -\u003e state_lock (spinlock, leaf)\\n  udev-\u003emutex -\u003e state_lock (spinlock, leaf)\\n  udev-\u003emutex -\u003e input_mutex -\u003e dev-\u003emutex -\u003e ff-\u003emutex (no back-edge)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/misc/uinput.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"71a9729f412e2c692a35c542e14b706fb342927f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"271ee71a1917b89f6d73ec82dd091c33d92ee617\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"974f7b138c3a96dd5cd53d1b33409cd7b2229dc6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"546c18a14924eb521fe168d916d7ce28f1e13c1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"a3d6c9c053c9c605651508569230ead633b13f76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"1e09dfbb4f5d20ee111f92325a00f85778a5f328\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"1534661043c434b81cfde26b97a2fb2460329cf0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff462551235d8d7d843a005950bc90924fcedede\",\"lessThan\":\"4cda78d6f8bf2b700529f2fbccb994c3e826d7c2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/misc/uinput.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.253\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.169\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.135\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.82\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.23\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.13\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.19.1\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"59C4CD77-5444-4760-B0D8-F238740397B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.169\",\"matchCriteriaId\":\"DBEC0E5D-641C-4E98-A6D9-5799B10CE451\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.135\",\"matchCriteriaId\":\"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.82\",\"matchCriteriaId\":\"02904CAE-71D2-45B3-9EC3-F6A9D18B6307\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.23\",\"matchCriteriaId\":\"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.13\",\"matchCriteriaId\":\"1490EF9B-9080-481C-8D22-1306AAE664E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:15:03+00:00",
      "cve": "CVE-2026-31667",
      "id": "CVE-2026-31667",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: uinput - fix circular locking dependency with ff-core",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31667.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-22T00:06:16Z",
      "cve": "CVE-2026-31667",
      "id": "CVE-2026-31667",
      "initial_release_date": "2026-04-25T01:36:34Z",
      "product_status:known_affected": "201",
      "product_status:known_not_affected": "78",
      "product_status:recommended": "128",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31667",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31667.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.