CVE-2026-31550

Vulnerability

Overview

CVE-2026-31550 describes a timing issue in the bcm2835_asb_control() function of the BCM2835 power domain driver (bcm2835-power) in the Linux kernel. The function polls the ASB (Application Specific Bridge) for an acknowledgment within a 1us timeout. Under heavy workloads on BCM2711, this tight loop can fail, especially for V3D's master ASB, resulting in an error such as "Failed to disable ASB master for v3d" during runtime PM suspend. The underlying root cause is that the timeout is insufficient for the hardware handshake to complete in all scenarios.

Exploitation

Context

The vulnerability is exploitable during runtime power management suspend operations. An attacker with local access to trigger significant GPU (V3D) workload could induce the timeout failure, potentially causing the power-off sequence to leave the V3D hardware in an inconsistent state. No special privileges beyond the ability to interact with the GPU are required, but the attack surface is local only. The affected component is a power domain driver used on Raspberry Pi 4 (BCM2711) and similar Broadcom SoCs.

Impact

A failed ASB handshake during power-off leaves the V3D block in a partially powered-down state. Subsequent access to V3D can cause bus faults, crashes, or even system hangs, leading to denial of service (DoS). The CVSS v3 score is 5.5 (Medium), reflecting the need for local access and the potential for disruption of availability. There is no evidence of data confidentiality or integrity impact.

Mitigation

The fix increases the polling timeout from 1us to 5us and replaces the open-coded ktime_get_ns()/cpu_relax() loop with the standard readl_poll_timeout_atomic() helper, improving both reliability and code clarity. The patch has been applied to the Linux kernel stable tree with commit IDs as referenced [1], [2], [3], [4]. Users should update their kernel to include this patch. No workaround is documented other than updating; the driver is not end-of-life (EOL). The issue is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.