CVE-2026-31545 - Vulnerability Details

- NFC: nxp-nci: allow GPIOs to sleep

Description

In the Linux kernel, the following vulnerability has been resolved:

NFC: nxp-nci: allow GPIOs to sleep

Allow the firmware and enable GPIOs to sleep.

This fixes a `WARN_ON' and allows the driver to operate GPIOs which are
connected to I2C GPIO expanders.

-- >8 --
kernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98
-- >8 --

Published: 2026-04-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the NXP NFC NCI driver contained a logic error that prevented certain GPIOs from sleeping, causing a WARN_ON and disabling operation of GPIOs connected to I2C expanders. The patch removes the warning and allows normal operation. No evidence of direct integrity, confidentiality, or availability compromise is documented; the issue is classified under CWE-372 and the ancillary NVD-CWE-noinfo, indicating potential defensive instrumentation problems rather than a clear attack vector.

Affected Systems

Any system running a Linux kernel that includes the nxp-nci NFC driver is affected. The problem is present in kernel versions prior to the commit that introduced the fix; the exact version ranges are not specified in the advisory.

Risk and Exploitability

The CVSS score of 5.5 places the vulnerability in the medium severity range. The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a very low likelihood of exploitation. No exploit code or proof‑of‑concept has been reported, and the described issue affects only internal driver behavior.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< 0c2320c3c860d281cbc2f49fc574c1947a6b9e2a
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< 2a175bc3c338c6b2bc55004e93dd35a2467bdca2
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< 70662874f646871c2f08ef1cf2544ba9a5f71b96
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< 548a1bfe591364e63bce4af7c5802bb434efdaf8
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< 4de9ed2ea22d611b4149969266b45a86ea8daf35
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< 783f05e560d761dee7ff602b97edb0e54f2e9727
`43201767b44cbd873c60dbd2acd370147588cb18`	affected	< 55dc632ab2ac2889b15995a9eef56c753d48ebc7

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[43201767b44cbd873c60dbd2acd370147588cb18,0c2320c3c860d281cbc2f49fc574c1947a6b9e2a)`	affected	code_commit	—
`[43201767b44cbd873c60dbd2acd370147588cb18,2a175bc3c338c6b2bc55004e93dd35a2467bdca2)`	affected	code_commit	—
`[43201767b44cbd873c60dbd2acd370147588cb18,c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78)`	affected	code_commit	—
`[43201767b44cbd873c60dbd2acd370147588cb18,70662874f646871c2f08ef1cf2544ba9a5f71b96)`	affected	code_commit	—
`[43201767b44cbd873c60dbd2acd370147588cb18,548a1bfe591364e63bce4af7c5802bb434efdaf8)`	affected	code_commit	—
`[43201767b44cbd873c60dbd2acd370147588cb18,4de9ed2ea22d611b4149969266b45a86ea8daf35)`	affected	code_commit	—
`[43201767b44cbd873c60dbd2acd370147588cb18,783f05e560d761dee7ff602b97edb0e54f2e9727)`	affected	code_commit	—
`[43201767b44cbd873c60dbd2acd370147588cb18,55dc632ab2ac2889b15995a9eef56c753d48ebc7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.4`	affected	semver	—
`[0,5.4)`	unaffected	semver	—
`[5.10.253,5.11.0)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to a Linux kernel release that contains the new nxp‑nci driver commit that allows GPIOs to sleep without triggering a WARN_ON.
If a kernel update is not immediately possible, disable the nxp‑nci driver or block usage of the affected GPIOs until the patch is applied to avoid the WARN_ON condition.
Continuously monitor kernel log output for any WARN_ON entries related to GPIOD or the NXP driver to detect lingering issues.

Generated by OpenCVE AI on April 28, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c2320c3c860d281cbc2f49fc574c1947a6b9e2a
https://git.kernel.org/stable/c/2a175bc3c338c6b2bc55004e93dd35a2467bdca2
https://git.kernel.org/stable/c/4de9ed2ea22d611b4149969266b45a86ea8daf35
https://git.kernel.org/stable/c/548a1bfe591364e63bce4af7c5802bb434efdaf8
https://git.kernel.org/stable/c/55dc632ab2ac2889b15995a9eef56c753d48ebc7
https://git.kernel.org/stable/c/70662874f646871c2f08ef1cf2544ba9a5f71b96
https://git.kernel.org/stable/c/783f05e560d761dee7ff602b97edb0e54f2e9727
https://git.kernel.org/stable/c/c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78
https://lore.kernel.org/linux-cve-announce/2026042424-CVE-2026-31545-ed19@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31545
https://www.cve.org/CVERecord?id=CVE-2026-31545

History

Tue, 28 Apr 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 25 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-372
References		https://lore.kernel.org/linux-cve-announce/2026042424-CVE-2026-31545-ed19@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31545 https://www.cve.org/CVERecord?id=CVE-2026-31545

Fri, 24 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NFC: nxp-nci: allow GPIOs to sleep Allow the firmware and enable GPIOs to sleep. This fixes a `WARN_ON' and allows the driver to operate GPIOs which are connected to I2C GPIO expanders. -- >8 -- kernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98 -- >8 --
Title		NFC: nxp-nci: allow GPIOs to sleep
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c2320c3c860d281cbc2f49fc574c1947a6b9e2a https://git.kernel.org/stable/c/2a175bc3c338c6b2bc55004e93dd35a2467bdca2 https://git.kernel.org/stable/c/4de9ed2ea22d611b4149969266b45a86ea8daf35 https://git.kernel.org/stable/c/548a1bfe591364e63bce4af7c5802bb434efdaf8 https://git.kernel.org/stable/c/55dc632ab2ac2889b15995a9eef56c753d48ebc7 https://git.kernel.org/stable/c/70662874f646871c2f08ef1cf2544ba9a5f71b96 https://git.kernel.org/stable/c/783f05e560d761dee7ff602b97edb0e54f2e9727 https://git.kernel.org/stable/c/c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-24T14:33:13.885Z

Updated: 2026-05-11T22:10:50.934Z

Reserved: 2026-03-09T15:48:24.114Z

Link: CVE-2026-31545

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-24T15:16:28.560

Modified: 2026-04-28T20:53:42.373

Link: CVE-2026-31545

Redhat

Severity :

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31545 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-29T00:00:13Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object