{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"e7824ec168d2ac883a213cd1f4d6cc0816002a85","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"5e8e06bf8909e79b4acd950cf578cfc2f10bbefa","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"de7c0c04ad868f2cee6671b11c0a6d20421af1da","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"7475dfad10a05a5bfadebf5f2499bd61b19ed293","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"92e47ad03e03dbb5515bdf06444bf6b1e147310d","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"71112e62807d1925dc3ae6188b11f8cfc85aec23","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"210d36d892de5195e6766c45519dfb1e65f3eb83","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"status":"affected","version":"f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463","versionType":"git"},{"status":"affected","version":"cf16e42709aa86aa3e37f3acc3d13d5715d90096","versionType":"git"},{"status":"affected","version":"61fa9f167caaa73d0a7c88f498eceeb12c6fa3db","versionType":"git"},{"status":"affected","version":"7874eee0130adf9bee28e8720bb5dd051089def3","versionType":"git"},{"status":"affected","version":"fc3b55ef2c840bb2746b2d8121a0788de84f7fac","versionType":"git"},{"lessThan":"4.5","status":"affected","version":"4.4.255","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.255","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.158","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.172","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"cveId":"CVE-2026-31555","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n    WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in 'exiting'.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n  CPU0\t\t\t     CPU1\t\t       CPU2\n  futex_lock_pi(uaddr)\n  // acquires the PI futex\n  exit()\n    futex_cleanup_begin()\n      futex_state = EXITING;\n\t\t\t     futex_lock_pi(uaddr)\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t   // observes EXITING\n\t\t\t\t   *exiting = owner;  // takes ref\n\t\t\t\t   return -EBUSY\n\t\t\t       wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct();   // drops ref\n\t\t\t       // exiting still points to owner\n\t\t\t       goto retry;\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t   cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t   // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t       wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi.","epss":{"date":"2026-11-05","percentile":0.02534,"score":0.00129},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915107708,"publishedAt":1777041339211,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e7824ec168d2ac883a213cd1f4d6cc0816002a85"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5e8e06bf8909e79b4acd950cf578cfc2f10bbefa"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/de7c0c04ad868f2cee6671b11c0a6d20421af1da"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/7475dfad10a05a5bfadebf5f2499bd61b19ed293"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/92e47ad03e03dbb5515bdf06444bf6b1e147310d"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/71112e62807d1925dc3ae6188b11f8cfc85aec23"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/210d36d892de5195e6766c45519dfb1e65f3eb83"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"remediation":[],"revision":"412eb247cd9bc19ba878c575addd0bd518b55e066f817e6c50ea72a9bdc1bcaf","sources":[{"modifiedAt":1793915107708,"name":"CNA: Linux","retrievedAt":1793917096349,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31555"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917101801,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31555"}],"ssvc":{"assessedAt":1793914721447,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"futex: Clear stale exiting pointer in futex_lock_pi() retry path","updatedAt":1793917101801}