CVE-2026-31741

What it actually does

CVE-2026-31741 is a local denial-of-service flaw in the Linux kernel rz-mtu3-cnt counter driver. The driver exposes a sysfs enable control for an RZ/MTU3 counter channel and incorrectly changes the Runtime PM usage count every time the file is written, even when the requested state is already active. Repeated writes of 0 can underflow the Runtime PM usage count and lead the driver to access hardware registers while clocks are disabled; repeated writes of 1 can over-increment the usage count and leave runtime power management in an inconsistent state. Writing 0 while PWM is active can also stop PWM without the counter owning the underlying MTU3 channel. The practical impact is local availability loss or device malfunction on systems using the affected driver and hardware.

Why it matters to the business

Successful exploitation can disrupt systems that rely on Renesas RZ/MTU3 counter or PWM functionality, causing device instability, loss of hardware-control functions, kernel warnings, or denial of service. The risk is most relevant to embedded, industrial, edge, automotive, IoT, or appliance-style Linux deployments where this kernel driver is present and local users or compromised services can write to the relevant sysfs interface. The CVSS score is moderate, EPSS is very low and flat, it is not in the CISA KEV catalog, and there is no public exploit maturity indicated, so broad internet-scale exploitation is unlikely; however, affected devices with local multi-user access or exposed application paths that can write to sysfs should still be patched during normal kernel maintenance windows.

How an attack unfolds

An attacker first needs local code execution or an account with permission to write to the affected sysfs enable file for the rz-mtu3-cnt counter device. Once that access exists, the attacker repeatedly writes the same value to the enable control instead of toggling it correctly. Multiple writes of 0 cause the Runtime PM usage counter to decrement repeatedly and underflow, potentially leaving the driver accessing MTU3 hardware registers while the device clocks are off. Multiple writes of 1 inflate the Runtime PM usage counter and can prevent normal power-management state recovery until enough matching disable operations occur. In another scenario, the attacker writes 0 while PWM is active, causing PWM to stop even though the counter is not the owner of the underlying channel. The result is disruption of counter/PWM functionality, device errors, and possible local denial of service on systems using the vulnerable driver.

How to fix it

Upgrade to a Linux kernel version that includes the rz-mtu3-cnt fix, which makes writes to the sysfs enable file idempotent by checking the cached count_is_enabled state and returning without changing Runtime PM state when the requested enable value is already set. Because no exact fixed versions were provided, use your Linux distribution, device vendor, or kernel maintainer advisories to identify the first patched kernel for your branch. For source-based kernels, apply the upstream patch for the rz-mtu3-cnt driver change titled "counter: rz-mtu3-cnt: prevent counter from being toggled multiple times." If immediate patching is not possible, restrict local write access to the affected sysfs counter enable files, remove unnecessary local users, confine services with mandatory access controls such as SELinux/AppArmor where applicable, and disable or unload the affected driver only if the hardware functionality is not required.

How to confirm the fix worked

Confirm the running kernel includes the patched rz-mtu3-cnt driver from the relevant vendor or upstream kernel branch. Validate package or image provenance using the distribution kernel changelog, vendor advisory, or commit history for the fix. On affected hardware, verify that repeated writes of the same value to the counter enable sysfs file no longer change Runtime PM usage state or produce underflow warnings. Review dmesg or kernel logs after testing for absence of messages such as "Runtime PM usage count underflow!" from rz-mtu3-counter. Also confirm that PWM and counter functions continue operating normally after repeated enable-state writes.

Typical attack path

1. Gain local shell, local application execution, or another path that permits writing to sysfs counter controls.
2. Identify the rz-mtu3-cnt counter sysfs enable file exposed by the kernel counter subsystem.
3. Repeatedly write the same value, especially 0, to the enable file instead of performing a normal enable/disable sequence.
4. Trigger Runtime PM usage count imbalance or underflow in the rz-mtu3-cnt driver.
5. Cause hardware register access while clocks are disabled, stop PWM unexpectedly, or leave the device in an inconsistent runtime power-management state.
6. Disrupt affected hardware functions or degrade system availability.

How to detect it

Look for evidence of local abuse through kernel logs, sysfs activity auditing, and process execution records. Primary log sources include dmesg, journald, /var/log/kern.log, /var/log/messages, auditd, EDR telemetry, and shell or process accounting logs if enabled. Search for rz-mtu3-counter Runtime PM warnings, repeated writes to counter enable sysfs files, unexpected PWM stoppage, and processes repeatedly invoking shell redirection, tee, echo, or custom binaries against /sys/bus/counter/devices/*/count*/enable or related rz-mtu3 counter paths. If Linux audit rules were configured for sysfs writes, correlate the writing process, user ID, parent process, and timestamp with kernel warnings. Because this is a local hardware-driver denial-of-service issue, there are no reliable remote network indicators; detection should focus on local kernel messages and repeated sysfs write behavior.

• Runtime PM usage count underflow!
• rz-mtu3-counter
• rz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!
• /sys/bus/counter/devices/
• /sys/bus/counter/devices/*/count*/enable
• /sys/bus/counter/devices/counter*/count*/enable
• echo 0 > /sys/bus/counter/devices/
• echo 1 > /sys/bus/counter/devices/
• tee /sys/bus/counter/devices/
• rz_mtu3_terminate_counter

What your security team should do

• Inventory Linux systems, embedded devices, appliances, and product images that use Renesas RZ/MTU3 hardware or include the rz-mtu3-cnt kernel driver.
• Prioritize remediation for devices where untrusted local users, containers, applications, or management agents may write to sysfs counter controls.
• Apply vendor-supported kernel updates or backport the upstream rz-mtu3-cnt fix into maintained kernel branches.
• Until patched, restrict write permissions and service access to affected sysfs enable files; enforce least privilege and MAC profiles for services that do not need hardware-control access.
• Monitor kernel logs for Runtime PM underflow messages and rz-mtu3-counter errors, especially on devices reporting PWM or counter malfunction.
• Treat exploitation risk as local and availability-focused; prioritize based on device criticality rather than internet exposure alone.