UnratedFix available
nvme-pci: ensure we're polling a polled queue
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.253, 5.15.203, 6.1.168, 6.12.80, 6.18.21, 6.19.11, 6.6.131
- CVEs
- CVE-2026-31523
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 08:55 UTC · Revision 1
Source evidence
nvme-pci: ensure we're polling a polled queue
core-osv · Original sourcePublished 22 Apr 2026, 13:54 UTC
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions.
osv:CVE-2026-31523
Kernel
Fixed versions: 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11
Complete source record
{
"id": "37c3758a0cb7920b237706f11dc96d6c02edc6d5fd0814e84f0ce41d70c131aa",
"url": "https://osv.dev/vulnerability/CVE-2026-31523",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "nvme-pci: ensure we're polling a polled queue",
"summary": "In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions.",
"evidence": "osv:CVE-2026-31523",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.253",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.203",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.168",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.131",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.80",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.21",
"evidence": "/affected/1/ranges"
},
{
"value": "6.19.11",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-31523",
"aliases": [
"CVE-2026-31523"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4b04cc6a8f86c4842314def22332de1f15de8523"
},
{
"fixed": "965e2c943f065122f14282a88d70a8a92e12a4da"
},
{
"fixed": "ba167d5982e2eb6ff9356d409eca592ce99555da"
},
{
"fixed": "0685dd9cb855ab77fcf3577b4702ba1d6df1c98d"
},
{
"fixed": "6f12734c4b619f923a4df0b1a46b8098b187d324"
},
{
"fixed": "acbc72dd1a09df53cafcf577259f4678be6afd6d"
},
{
"fixed": "b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3"
},
{
"fixed": "b222680ba55e018426c4535067a008f1d81a5d21"
},
{
"fixed": "166e31d7dbf6aa44829b98aa446bda5c9580f12a"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31523.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.10.253"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.203"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.168"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.131"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.80"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.21"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "6.19.11"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31523.json"
}
}
],
"modified": "2026-10-28T02:30:34.253370252Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0685dd9cb855ab77fcf3577b4702ba1d6df1c98d",
"https://git.kernel.org/stable/c/166e31d7dbf6aa44829b98aa446bda5c9580f12a",
"https://git.kernel.org/stable/c/6f12734c4b619f923a4df0b1a46b8098b187d324",
"https://git.kernel.org/stable/c/965e2c943f065122f14282a88d70a8a92e12a4da",
"https://git.kernel.org/stable/c/acbc72dd1a09df53cafcf577259f4678be6afd6d",
"https://git.kernel.org/stable/c/b222680ba55e018426c4535067a008f1d81a5d21",
"https://git.kernel.org/stable/c/b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3",
"https://git.kernel.org/stable/c/ba167d5982e2eb6ff9356d409eca592ce99555da",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31523.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-31523",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31523.json"
}
},
"related_cves": [
{
"value": "CVE-2026-31523",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 501276,
"published_at": "2026-04-22T13:54:37.568+00:00"
}