CVE-2026-31740

What it actually does

This is a local Linux kernel race condition in the Renesas RZ/MTU3 counter/PWM driver area. The counter and PWM sub-drivers can both write their own struct device pointer into a shared rz_mtu3_channel structure for overlapping hardware channels. Depending on probe order, the counter driver may later perform runtime power-management operations against the wrong device object. The practical impact is availability loss: a local user or local workload with the ability to trigger the affected driver path may cause incorrect runtime PM behavior, device malfunction, kernel warnings, hangs, or a crash. The CVSS vector indicates local access, low attack complexity, low privileges, no user interaction, and high availability impact, with no expected confidentiality or integrity impact.

Why it matters to the business

Organizations running Linux on hardware that uses the affected Renesas RZ/MTU3 counter/PWM functionality may experience local denial of service, device instability, or system outages if the flawed driver path is triggered. The risk is most relevant to embedded, industrial, IoT, or appliance-style Linux deployments where these hardware timer/counter/PWM channels are present and enabled. EPSS is very low, there is no known public exploit maturity, and it is not listed in CISA KEV or associated with ransomware, so broad internet-scale exploitation is unlikely; however, availability-sensitive systems should still prioritize kernel updates because a local crash in embedded or operational environments can interrupt service.

How an attack unfolds

An attacker first needs local access to a system using the affected Linux kernel driver and relevant Renesas RZ/MTU3 hardware. They then interact with kernel-exposed interfaces that cause the affected counter and PWM sub-drivers to initialize or operate on shared hardware channels. Because the shared channel structure can hold the wrong device pointer depending on probe ordering, the counter driver may perform runtime power-management actions on an unintended device. Repeated triggering can lead to unstable device state, runtime PM errors, driver malfunction, kernel warnings, or a denial-of-service condition such as a hang or crash. This vulnerability does not provide a known path to remote code execution, privilege escalation, or data theft based on the supplied details.

How to fix it

Upgrade to a Linux kernel version or vendor-supplied kernel package that includes the fix for the RZ/MTU3 counter driver. The fix changes the counter driver to use the correct parent device pointer assigned during probe rather than the shared channel device pointer that can be overwritten by the PWM driver. No exact fixed package versions were provided, so use the relevant distribution, device vendor, or board-support-package advisory to identify the first fixed kernel for your platform. Where immediate patching is not possible, reduce exposure by disabling the affected driver or module if unused, disabling unused counter/PWM functionality in the device tree or kernel configuration, restricting local shell access, limiting access to device/sysfs interfaces, and applying operational monitoring for kernel crashes or runtime PM errors. Mitigations should be treated as temporary because the root cause is in kernel driver logic.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel contains the upstream/vendor patch for the RZ/MTU3 counter driver and that the installed kernel package is at or above the vendor-declared fixed version. Validate that the system has rebooted into the fixed kernel, not merely installed it. On affected hardware, exercise normal counter and PWM functionality and review dmesg or journal logs for runtime PM warnings, driver probe errors, kernel oopses, hangs, or panics. If the driver is not needed and has been disabled, confirm it is not built in, not loaded as a module, and not instantiated by the device tree or platform firmware. For fleet checks, inventory Linux systems using Renesas RZ/MTU3 hardware or loading rz-mtu3-related drivers, then compare their running kernel build IDs against vendor advisories.

Typical attack path

1. Obtain local, low-privileged access to a Linux system with the affected RZ/MTU3 counter/PWM driver enabled and relevant hardware present.
2. Identify exposed counter, PWM, sysfs, or device interfaces associated with the RZ/MTU3 driver.
3. Trigger driver probe or runtime operations involving overlapping hardware channels used by both the counter and PWM sub-drivers.
4. Cause the counter driver to use an incorrect struct device pointer for runtime power-management operations.
5. Repeat or time the operations to induce runtime PM inconsistency, device malfunction, kernel warnings, a hang, or a kernel crash.
6. Use the resulting denial of service to disrupt the host, embedded appliance, or operational workload.

How to detect it

There are no known public exploitation indicators or named threat actors associated with this issue from the supplied data. Detection should focus on two goals: identifying exposure and finding signs of attempted or accidental triggering. For exposure, collect kernel version, loaded modules, device-tree/platform hardware data, and dmesg or journal entries referencing RZ/MTU3 counter or PWM drivers. For possible exploitation or impact, review kernel logs, persistent journal entries, crash dumps, pstore records, kdump/vmcore artifacts, watchdog reset logs, and device health telemetry for runtime power-management errors, driver probe anomalies, kernel oopses, soft lockups, hard lockups, panics, or unexplained reboots involving rz-mtu3 counter/PWM components. Because crashes may erase volatile logs, ensure persistent kernel logging, pstore, or kdump is enabled on high-value embedded systems. Treat generic panics as suspicious only when correlated with affected hardware, affected kernel versions, and rz-mtu3-related log context.

• rz-mtu3-cnt
• rz-mtu3-pwm
• rz_mtu3
• rz_mtu3_channel
• Runtime PM usage count underflow
• runtime PM
• kernel BUG
• Kernel panic - not syncing
• Oops:
• soft lockup
• hard LOCKUP
• watchdog: BUG: soft lockup
• Unable to handle kernel NULL pointer dereference

What your security team should do

• Inventory Linux systems, appliances, and embedded devices that use Renesas RZ/MTU3 counter or PWM functionality.
• Prioritize patching for availability-sensitive systems, embedded devices, industrial control appliances, and systems where local users or untrusted workloads can access hardware interfaces.
• Apply the vendor-provided fixed kernel or board-support-package update, then reboot into the corrected kernel.
• If patching is delayed, disable unused RZ/MTU3 counter/PWM drivers or device-tree nodes and restrict local access to relevant device interfaces.
• Monitor kernel logs for rz-mtu3 driver errors, runtime PM anomalies, kernel oopses, hangs, or unexplained reboots.
• Because this is not KEV-listed, has very low EPSS, and has no known exploit maturity, handle through normal vulnerability management unless the affected hardware supports critical operations.
• Document affected hardware models and kernel branches so future kernel driver advisories can be triaged quickly.