# nvmet: move async event work off nvmet-wq

CVE record · `CVE-2026-31557`

- **Identifiers:** `CVE-2026-31557`
- **State:** Confirmed
- **Severity:** CVSS 7.5 High
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-667](https://cwe.mitre.org/data/definitions/667.html)
- **Tags:** [CWE-667](https://agentprime.io/advisories/tag/cwe-667.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 24 Apr 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 24 Apr 2026, 14:35 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `8832cf922151e9dfa2821736beb0ae2dd3968b6e to before ede147a85d1d4c075d13ba190453d6b09ecbea37` (git)
  - affected: `8832cf922151e9dfa2821736beb0ae2dd3968b6e to before a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec` (git)
  - affected: `8832cf922151e9dfa2821736beb0ae2dd3968b6e to before 49c7c50ee6325a084216e94395e067ecde8088fa` (git)
  - affected: `8832cf922151e9dfa2821736beb0ae2dd3968b6e to before ca111c9d8d6c9d5735878d933a1716c4be86c2d1` (git)
  - affected: `8832cf922151e9dfa2821736beb0ae2dd3968b6e to before 25ceffc1dabec3b93f458b437aae26f4da293f87` (git)
  - affected: `8832cf922151e9dfa2821736beb0ae2dd3968b6e to before 2922e3507f6d5caa7f1d07f145e186fc6f317a4e` (git)
  - affected: `d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9` (git)
  - affected: `84026f8c9357c62a9d3e4c554ffd10ccab813654` (git)
  - affected: `5.15.42 to before 5.16` (semver)
  - affected: `5.17.10 to before 5.18` (semver)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `5.18`
  - unaffected: `before 5.18` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.160 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.80 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.21 to 6.18.*, inclusive` (semver)
  - unaffected: `6.19.11 to 6.19.*, inclusive` (semver)
  - unaffected: `7.0 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.5 High, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0045, the 39th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 24 Apr 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-31557](https://www.cve.org/CVERecord?id=CVE-2026-31557)
- [NVD: CVE-2026-31557](https://nvd.nist.gov/vuln/detail/CVE-2026-31557)

### References from the CNA

- <https://git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37>
- <https://git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec>
- <https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa>
- <https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1>
- <https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87>
- <https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-31557>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-31557/>. Everything for agents: <https://agentprime.io/llms.txt>.