CVE record · CVE-2026-31557

nvmet: move async event work off nvmet-wq

CVSS 7.5 HighEPSS 0.0045 · 39th percentile

Published by the CVE Program (CNA: Linux) at 24 Apr 2026, 14:35 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected 8832cf922151e9dfa2821736beb0ae2dd3968b6e to before ede147a85d1d4c075d13ba190453d6b09ecbea37 git affected 8832cf922151e9dfa2821736beb0ae2dd3968b6e to before a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec git affected 8832cf922151e9dfa2821736beb0ae2dd3968b6e to before 49c7c50ee6325a084216e94395e067ecde8088fa git affected 8832cf922151e9dfa2821736beb0ae2dd3968b6e to before ca111c9d8d6c9d5735878d933a1716c4be86c2d1 git affected 8832cf922151e9dfa2821736beb0ae2dd3968b6e to before 25ceffc1dabec3b93f458b437aae26f4da293f87 git affected 8832cf922151e9dfa2821736beb0ae2dd3968b6e to before 2922e3507f6d5caa7f1d07f145e186fc6f317a4e git affected d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9 git affected 84026f8c9357c62a9d3e4c554ffd10ccab813654 git affected 5.15.42 to before 5.16 semver affected 5.17.10 to before 5.18 semver Other versions: unaffected
Linux	Linux	affected 5.18 unaffected before 5.18 semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.80 to 6.12., inclusive semver unaffected 6.18.21 to 6.18., inclusive semver unaffected 6.19.11 to 6.19., inclusive semver unaffected 7.0 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-31557
CNA: Linux
Weakness (CWE): CWE-667
Tags: Linux kernel
CWE-667
Published: 24 Apr 2026
Updated: 30 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CNA (Linux)

CISA KEV Not listed.
EPSS 0.0045, the 39th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 24 Apr 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.