{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "EF897730-3F1E-47A2-8B07-22535202C487",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclockevents: Add missing resets of the next_event_forced flag\n\nThe prevention mechanism against timer interrupt starvation missed to reset\nthe next_event_forced flag in a couple of places:\n\n    - When the clock event state changes. That can cause the flag to be\n      stale over a shutdown/startup sequence\n\n    - When a non-forced event is armed, which then prevents rearming before\n      that event. If that event is far out in the future this will cause\n      missed timer interrupts.\n\n    - In the suspend wakeup handler.\n\nThat led to stalls which have been reported by several people.\n\nAdd the missing resets, which fixes the problems for the reporters."
    }
  ],
  "id": "CVE-2026-31574",
  "lastModified": "2026-05-19T14:22:43.347",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-04-24T15:16:32.020",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4096fd0e8eaea13ebe5206700b33f49635ae18e5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9401b593fa48218d2667df1610b0ebc518554880"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-31574"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-24T15:16:32Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclockevents: Add missing resets of the next_event_forced flag\n\nThe prevention mechanism against timer interrupt starvation missed to reset\nthe next_event_forced flag in a couple of places:\n\n    - When the clock event state changes. That can cause the flag to be\n      stale over a shutdown/startup sequence\n\n    - When a non-forced event is armed, which then prevents rearming before\n      that event. If that event is far out in the future this will cause\n      missed timer interrupts.\n\n    - In the suspend wakeup handler.\n\nThat led to stalls which have been reported by several people.\n\nAdd the missing resets, which fixes the problems for the reporters.",
  "id": "GHSA-w5vp-hvm6-339g",
  "modified": "2026-04-27T21:30:47Z",
  "published": "2026-04-24T15:32:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31574"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4096fd0e8eaea13ebe5206700b33f49635ae18e5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9401b593fa48218d2667df1610b0ebc518554880"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-31574 clockevents: Add missing resets of the next_event_forced flag - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31574.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "clockevents: Add missing resets of the next_event_forced flag",
    "tracking": {
      "current_release_date": "2026-05-22T14:38:20.000Z",
      "generator": {
        "date": "2026-05-23T07:37:10.858Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-31574",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-04-26T01:03:01.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-04-27T14:41:31.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2026-04-29T01:03:08.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2026-04-29T14:55:01.000Z",
          "legacy_version": "4",
          "number": "4",
          "summary": "Information published."
        },
        {
          "date": "2026-05-06T14:39:34.000Z",
          "legacy_version": "5",
          "number": "5",
          "summary": "Information published."
        },
        {
          "date": "2026-05-11T01:51:15.000Z",
          "legacy_version": "6",
          "number": "6",
          "summary": "Information published."
        },
        {
          "date": "2026-05-17T14:52:21.000Z",
          "legacy_version": "7",
          "number": "7",
          "summary": "Information published."
        },
        {
          "date": "2026-05-22T14:38:20.000Z",
          "legacy_version": "8",
          "number": "8",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "8"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              },
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "cbl2 kernel 0:5.15.202.1-1.cbl2",
                "product": {
                  "name": "cbl2 kernel 0:5.15.202.1-1.cbl2",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.134.1-2.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.134.1-2.azl3",
                  "product_id": "4"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.137.1-2.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.137.1-2.azl3",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.130.1-3.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.130.1-3.azl3",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.138.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.138.1-1.azl3",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 kernel 0:6.6.139.1-1.azl3",
                "product": {
                  "name": "\u003cazl3 kernel 0:6.6.139.1-1.azl3",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 kernel 0:6.6.139.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.139.1-1.azl3",
                  "product_id": "21344"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 kernel 0:5.15.202.1-1.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.134.1-2.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.137.1-2.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.130.1-3.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.138.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 kernel 0:6.6.139.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.139.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "21344-17084"
        },
        "product_reference": "21344",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-31574",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "21344-17084"
        ],
        "known_affected": [
          "17086-6",
          "17084-4",
          "17084-3",
          "17084-5",
          "17084-2",
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-31574 clockevents: Add missing resets of the next_event_forced flag - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31574.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-04-26T01:03:01.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17086-6"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-26T01:03:01.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-4"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-26T01:03:01.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-3"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-26T01:03:01.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-5"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-04-26T01:03:01.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-2"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2026-04-26T01:03:01.000Z",
          "details": "0:6.6.139.1-1.azl3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "title": "clockevents: Add missing resets of the next_event_forced flag"
    }
  ]
}