CVE-2026-31667 - Vulnerability Details

- Input: uinput - fix circular locking dependency with ff-core

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: uinput - fix circular locking dependency with ff-core

A lockdep circular locking dependency warning can be triggered
reproducibly when using a force-feedback gamepad with uinput (for
example, playing ELDEN RING under Wine with a Flydigi Vader 5
controller):

ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex

The cycle is caused by four lock acquisition paths:

1. ff upload: input_ff_upload() holds ff->mutex and calls
uinput_dev_upload_effect() -> uinput_request_submit() ->
uinput_request_send(), which acquires udev->mutex.

2. device create: uinput_ioctl_handler() holds udev->mutex and calls
uinput_create_device() -> input_register_device(), which acquires
input_mutex.

3. device register: input_register_device() holds input_mutex and
calls kbd_connect() -> input_register_handle(), which acquires
dev->mutex.

4. evdev release: evdev_release() calls input_flush_device() under
dev->mutex, which calls input_ff_flush() acquiring ff->mutex.

Fix this by introducing a new state_lock spinlock to protect
udev->state and udev->dev access in uinput_request_send() instead of
acquiring udev->mutex. The function only needs to atomically check
device state and queue an input event into the ring buffer via
uinput_dev_event() -- both operations are safe under a spinlock
(ktime_get_ts64() and wake_up_interruptible() do not sleep). This
breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in
the lock ordering and cannot form cycles with mutexes.

To keep state transitions visible to uinput_request_send(), protect
writes to udev->state in uinput_create_device() and
uinput_destroy_device() with the same state_lock spinlock.

Additionally, move init_completion(&request->done) from
uinput_request_send() to uinput_request_submit() before
uinput_request_reserve_slot(). Once the slot is allocated,
uinput_flush_requests() may call complete() on it at any time from
the destroy path, so the completion must be initialised before the
request becomes visible.

Lock ordering after the fix:

ff->mutex -> state_lock (spinlock, leaf)
udev->mutex -> state_lock (spinlock, leaf)
udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)

Published: 2026-04-24

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a circular locking dependency in the Linux kernel’s uinput subsystem that can be triggered when a force‑feedback gamepad queues an effect. A lock ordering cycle—ff mutex → udev mutex → input mutex → dev mutex → ff mutex—produces a lockdep warning that signals a violation of kernel lock ordering rules. The CVE description does not report a kernel deadlock, but the presence of the warning and the nature of the cycle suggests the possibility that the system could become unresponsive if the cycle were to occur during normal operation. This flaw is a concurrency weakness classified under CWE-667 and CWE-833.

Affected Systems

All Linux kernel releases are affected, from the 2.6.19 branch through the current 7.0 series including all release candidates (rc1 through rc7). The kernel CPE list includes every kernel version, indicating that any install of the kernel without the patch is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.8 reflects a high severity availability impact. The EPSS score is below 1%, and the vulnerability is not in the CISA KEV catalog, indicating a low exploitation probability. The flaw can be triggered by local use of a force‑feedback device such as a gamepad using uinput, or by a process that can drive the device. If the lock ordering cycle were to occur under normal operation, it could potentially lead to a deadlock and a local denial of service, but the CVE description does not confirm that a deadlock occurs. The fix replaces the udev mutex acquisition with a spinlock (state_lock) that breaks the circular dependency, restoring safe lock ordering.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< 71a9729f412e2c692a35c542e14b706fb342927f
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< 271ee71a1917b89f6d73ec82dd091c33d92ee617
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< 974f7b138c3a96dd5cd53d1b33409cd7b2229dc6
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< 546c18a14924eb521fe168d916d7ce28f1e13c1d
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< a3d6c9c053c9c605651508569230ead633b13f76
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< 1e09dfbb4f5d20ee111f92325a00f85778a5f328
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< 1534661043c434b81cfde26b97a2fb2460329cf0
`ff462551235d8d7d843a005950bc90924fcedede`	affected	< 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2

Linux

affected

Version	Status	Constraints
`2.6.19`	affected	—
`0`	unaffected	< 2.6.19
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.169`	unaffected	≤ 6.1.*
`6.6.135`	unaffected	≤ 6.6.*
`6.12.82`	unaffected	≤ 6.12.*
`6.18.23`	unaffected	≤ 6.18.*
`6.19.13`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.19:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ff462551235d8d7d843a005950bc90924fcedede,71a9729f412e2c692a35c542e14b706fb342927f)`	affected	code_commit	—
`[ff462551235d8d7d843a005950bc90924fcedede,271ee71a1917b89f6d73ec82dd091c33d92ee617)`	affected	code_commit	—
`[ff462551235d8d7d843a005950bc90924fcedede,974f7b138c3a96dd5cd53d1b33409cd7b2229dc6)`	affected	code_commit	—
`[ff462551235d8d7d843a005950bc90924fcedede,546c18a14924eb521fe168d916d7ce28f1e13c1d)`	affected	code_commit	—
`[ff462551235d8d7d843a005950bc90924fcedede,a3d6c9c053c9c605651508569230ead633b13f76)`	affected	code_commit	—
`[ff462551235d8d7d843a005950bc90924fcedede,1e09dfbb4f5d20ee111f92325a00f85778a5f328)`	affected	code_commit	—
`[ff462551235d8d7d843a005950bc90924fcedede,1534661043c434b81cfde26b97a2fb2460329cf0)`	affected	code_commit	—
`[ff462551235d8d7d843a005950bc90924fcedede,4cda78d6f8bf2b700529f2fbccb994c3e826d7c2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.19`	affected	semver	—
`[0,2.6.19)`	unaffected	generic	—
`[5.10.253,5.11.0)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.169,6.2.0)`	unaffected	semver	—
`[6.6.135,6.7.0)`	unaffected	semver	—
`[6.12.82,6.13.0)`	unaffected	semver	—
`[6.18.23,6.19.0)`	unaffected	semver	—
`[6.19.13,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the uinput state_lock patch (commit 1534661043c434b81cfde26b97a2fb2460329cf0 and its backports).
Disable user‑mode force‑feedback devices that use uinput until the patch is applied, for example by masking the ff module or preventing device creation via uinput.
If a kernel update is not immediately possible, monitor lockdep warnings and reboot the system to recover from a deadlock caused by the circular lock dependency.

Generated by OpenCVE AI on April 28, 2026 at 13:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0
https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328
https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617
https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2
https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d
https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f
https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6
https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76
https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31667-a1a7@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31667
https://www.cve.org/CVERecord?id=CVE-2026-31667

History

Mon, 27 Apr 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-667
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.19:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Mon, 27 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026042406-CVE-2026-31667-a1a7@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31667 https://www.cve.org/CVERecord?id=CVE-2026-31667
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 24 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Input: uinput - fix circular locking dependency with ff-core A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for example, playing ELDEN RING under Wine with a Flydigi Vader 5 controller): ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex The cycle is caused by four lock acquisition paths: 1. ff upload: input_ff_upload() holds ff->mutex and calls uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), which acquires udev->mutex. 2. device create: uinput_ioctl_handler() holds udev->mutex and calls uinput_create_device() -> input_register_device(), which acquires input_mutex. 3. device register: input_register_device() holds input_mutex and calls kbd_connect() -> input_register_handle(), which acquires dev->mutex. 4. evdev release: evdev_release() calls input_flush_device() under dev->mutex, which calls input_ff_flush() acquiring ff->mutex. Fix this by introducing a new state_lock spinlock to protect udev->state and udev->dev access in uinput_request_send() instead of acquiring udev->mutex. The function only needs to atomically check device state and queue an input event into the ring buffer via uinput_dev_event() -- both operations are safe under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in the lock ordering and cannot form cycles with mutexes. To keep state transitions visible to uinput_request_send(), protect writes to udev->state in uinput_create_device() and uinput_destroy_device() with the same state_lock spinlock. Additionally, move init_completion(&request->done) from uinput_request_send() to uinput_request_submit() before uinput_request_reserve_slot(). Once the slot is allocated, uinput_flush_requests() may call complete() on it at any time from the destroy path, so the completion must be initialised before the request becomes visible. Lock ordering after the fix: ff->mutex -> state_lock (spinlock, leaf) udev->mutex -> state_lock (spinlock, leaf) udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
Title		Input: uinput - fix circular locking dependency with ff-core
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0 https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328 https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617 https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6 https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-24T14:45:15.937Z

Updated: 2026-05-11T22:13:16.401Z

Reserved: 2026-03-09T15:48:24.129Z

Link: CVE-2026-31667

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-24T15:16:46.390

Modified: 2026-04-27T20:00:40.187

Link: CVE-2026-31667

Redhat

Severity : Moderate

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31667 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T13:45:06Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object