CVE-2026-31545

Root

Cause

The vulnerability in the Linux kernel's NXP-NCI NFC driver occurs because the driver uses gpiod_set_value() without allowing the GPIO to sleep, triggering a kernel WARN_ON when the GPIO is connected to an I2C GPIO expander that requires sleeping [1]. Since GPIO operations can be called from atomic contexts, the driver must use the gpiod_set_value_cansleep() variant to avoid the warning.

Exploitation

An attacker with local access or the ability to trigger NFC operations (e.g., through the NFC subsystem) can cause the kernel to emit the warning, potentially leading to a denial-of-service condition if repeated. No special privileges are required beyond the ability to interact with the NFC driver.

Impact

While the warning itself does not directly corrupt data, it indicates a kernel bug that could lead to system instability if the GPIO operation fails. The CVSS score of 5.5 (medium) reflects the potential for local denial of service.

Mitigation

The fix has been applied to the Linux kernel stable branches [1]. Users should update to a kernel version that includes the commit c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78 or later.