CVE-2026-31545

What it actually does

This is a local Linux kernel availability flaw in the NXP NCI NFC driver. The driver can call the GPIO API in a way that does not permit sleeping, even when the firmware or enable GPIO is backed by a controller such as an I2C GPIO expander that may sleep. On affected systems with the relevant NFC hardware/driver path, this can trigger a kernel WARN_ON in gpiolib. If the system is configured to panic on kernel warnings, the warning can crash the host; otherwise it may cause driver instability, repeated kernel log noise, or NFC device malfunction. The issue is local, requires low privileges, and does not provide confidentiality or integrity impact.

Why it matters to the business

The main risk is disruption of systems that include the affected Linux kernel NFC driver and compatible NXP NFC hardware, especially embedded, mobile, kiosk, point-of-sale, access-control, or appliance-style devices where NFC functionality is operationally important. Systems configured with panic_on_warn are at higher risk because a driver warning can become a full system crash. The vulnerability is not currently in CISA KEV, is not known to be used in ransomware campaigns, has no known public exploit maturity, and has a very low and flat EPSS score, so broad internet-scale exploitation is unlikely; however, local disruption remains relevant for devices where untrusted users can interact with NFC features or gain local code execution.

How an attack unfolds

An attacker first needs local access to an affected Linux system, either through an existing low-privileged account, local application execution, or another foothold. The system must load and use the NXP NCI NFC driver with GPIO lines that may sleep, such as GPIOs exposed through an I2C GPIO expander. The attacker then repeatedly exercises the NFC subsystem or triggers driver operations that toggle the firmware or enable GPIO. On vulnerable kernels, the driver may invoke gpiod_set_value in a context where sleeping is not allowed, causing the kernel to emit a WARN_ON from gpiolib. If kernel.panic_on_warn is enabled, this warning can immediately panic and reboot or halt the system. If panic_on_warn is not enabled, the likely result is NFC service disruption, repeated kernel warnings, or degraded device stability rather than a complete compromise.

How to fix it

Upgrade to a Linux kernel build from the operating system, appliance, or device vendor that includes the upstream fix for the NXP NCI NFC driver change commonly described as "NFC: nxp-nci: allow GPIOs to sleep." No exact fixed package versions were provided in the input, so use vendor advisories and distribution security trackers to identify the corrected kernel package for each supported platform. Where immediate patching is not possible, reduce exposure by disabling unused NFC functionality, preventing automatic loading of the nxp-nci driver where NFC is not required, restricting local shell/application access to trusted users, and reviewing whether kernel.panic_on_warn is enabled. Disabling panic_on_warn may reduce crash impact from this bug, but it should be treated as a temporary risk tradeoff rather than a substitute for patching.

How to confirm the fix worked

Confirm the running kernel package is at or above the vendor-fixed build that contains the nxp-nci GPIO sleep fix. Validate that the relevant patch is present in source-based environments by checking that the nxp-nci driver uses a sleep-capable GPIO setter for firmware and enable GPIO operations. On running systems, check whether the NXP NCI driver is present or loaded using module, sysfs, and kernel configuration inspection. Review kernel logs after exercising NFC functionality and confirm there are no new WARN_ON entries from drivers/gpio/gpiolib.c involving gpiod_set_value and nxp-nci. Also verify panic behavior by checking kernel.panic_on_warn settings and ensuring operational monitoring would detect any kernel warning, oops, panic, or reboot associated with the NFC driver.

Typical attack path

1. Obtain local low-privileged access to a Linux system that includes the affected NXP NCI NFC driver and relevant NFC/GPIO hardware.
2. Confirm the NFC device/driver path is available, for example through loaded kernel modules, device nodes, sysfs, or NFC tooling.
3. Trigger NFC operations that cause the nxp-nci driver to manipulate firmware or enable GPIO lines.
4. Cause the vulnerable GPIO call path to execute when the backing GPIO controller can sleep, such as through an I2C GPIO expander.
5. Generate a kernel WARN_ON in gpiolib at gpiod_set_value.
6. If panic_on_warn is enabled, cause a kernel panic and service outage; otherwise, cause driver instability, log flooding, or NFC functionality failure.

How to detect it

Look for evidence of kernel warnings, panics, or repeated NFC driver failures in kernel log sources such as dmesg, journald, /var/log/kern.log, /var/log/messages, crash dumps, pstore, netconsole output, and centralized syslog. Focus on warnings that reference drivers/gpio/gpiolib.c, gpiod_set_value, and nxp-nci around the time of NFC activity, local user sessions, application launches, or unexpected reboots. If panic_on_warn is enabled, correlate warning timestamps with system boot records, watchdog resets, kdump/vmcore creation, pstore console logs, or availability monitoring gaps. Also review whether the nxp-nci module was loaded unexpectedly, whether NFC services were started or exercised shortly before the warning, and whether repeated warnings suggest intentional triggering rather than incidental hardware initialization. There are no known threat actors or ransomware campaigns associated with this vulnerability in the provided data.

• drivers/gpio/gpiolib.c:3880
• gpiod_set_value+0x88/0x98
• WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98
• kernel: WARNING: CPU:
• nxp-nci
• NFC: nxp-nci
• panic_on_warn
• /sys/module/nxp_nci
• /sys/module/nxp_nci_i2c
• nxp_nci
• nxp_nci_i2c

What your security team should do

• Prioritize inventory first: identify Linux systems with NFC capability, NXP NCI hardware, the nxp-nci driver, or embedded/mobile/appliance profiles where this driver may be enabled.
• Patch affected systems through vendor-supported kernel updates once a corrected build is available for the platform.
• For systems that do not require NFC, disable NFC support or prevent the nxp-nci driver from loading as a compensating control.
• Review kernel.panic_on_warn; systems with it enabled should be treated as higher priority because this warning can become a crash.
• Add monitoring for kernel WARN_ON, oops, panic, and reboot events referencing gpiod_set_value, gpiolib, or nxp-nci.
• Because EPSS is very low, exploit maturity is listed as none, and the CVE is not in KEV, prioritize based on local access exposure and operational criticality rather than internet exposure alone.
• For embedded or physical-accessible devices, include this issue in hardening reviews because attackers with local app execution or physical interaction may be able to trigger availability impact.