{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31552", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.115Z", "datePublished": "2026-04-24T14:33:19.065Z", "dateUpdated": "2026-08-05T12:23:26.516Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:26.516Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - Remote network traffic can cause an affected wlcore-backed host or embedded device to transmit packets through the vulnerable TX path, and an adjacent WiFi attacker can also trigger AP/P2P management/data transmissions. Scoring uses the highest reasonable deployment where the device is reachable over IP via WiFi.\nAC:L - Once `pskb_expand_head()` fails for an skb with insufficient headroom, the erroneous `-EAGAIN` handling deterministically requeues and immediately retries the same skb in a tight loop. There is no race to win, and traffic flooding can sustain the TX/allocation pressure.\nPR:N - An attacker does not need local credentials to induce network or WiFi-originated transmissions in a reachable AP/station/embedded deployment. The vulnerable driver path itself has no authentication or privilege check once packets are queued for transmission.\nUI:N - No victim user action is required after the affected WiFi interface is operating. Attacker-supplied traffic can trigger the transmit path automatically.\nS:U - The impact is confined to the same kernel and device security authority. There is no VM, IOMMU, or separate security-scope boundary crossing.\nC:N - The fixed bug is an error-code confusion that causes an infinite retry loop after allocation failure. The failing `pskb_expand_head()` leaves the skb unmodified and does not provide an information disclosure primitive.\nI:N - The bug does not corrupt memory or modify attacker-chosen data; it requeues the same skb and spins. No arbitrary write or control-flow primitive is exposed by this issue.\nA:H - The loop runs immediately under `wl->mutex` with `GFP_ATOMIC` retry and can cause a CPU soft lockup. This is a kernel-level availability failure and can hang or severely degrade affected systems." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ti/wlcore/tx.c" ], "versions": [ { "version": "88295a55fefe5414e64293638b6f7549646e58ed", "lessThan": "980f793645540ca7a6318165cc12f49d5febeb99", "status": "affected", "versionType": "git" }, { "version": "cd89a4656c03f8db0c57350aaec69cd3cfaa3522", "lessThan": "12f9eef39e49716c763714bfda835a733d5f6dea", "status": "affected", "versionType": "git" }, { "version": "745a0810dbc96a0471e5f5e627ba1e978c3116d4", "lessThan": "ceb46b40b021d21911ff8608ce4ed33c1264ad2f", "status": "affected", "versionType": "git" }, { "version": "b167312390fdd461c81ead516f2b0b44e83a9edb", "lessThan": "a6dc74209462c4fe5a88718d2f3a5286886081c8", "status": "affected", "versionType": "git" }, { "version": "71de0b6e04bbee5575caf9a1e4d424e7dcc50018", "lessThan": "cfa64e2b3717be1da7c4c1aff7268a009e8c1610", "status": "affected", "versionType": "git" }, { "version": "689a7980e4788e13e766763d53569fb78dea2513", "lessThan": "46c670ff1ff466e5eccb3940f726586473dc053c", "status": "affected", "versionType": "git" }, { "version": "e75665dd096819b1184087ba5718bd93beafff51", "lessThan": "f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c", "status": "affected", "versionType": "git" }, { "version": "e75665dd096819b1184087ba5718bd93beafff51", "lessThan": "deb353d9bb009638b7762cae2d0b6e8fdbb41a69", "status": "affected", "versionType": "git" }, { "version": "5.10.250", "lessThan": "5.10.253", "status": "affected", "versionType": "semver" }, { "version": "5.15.200", "lessThan": "5.15.203", "status": "affected", "versionType": "semver" }, { "version": "6.1.163", "lessThan": "6.1.167", "status": "affected", "versionType": "semver" }, { "version": "6.6.124", "lessThan": "6.6.130", "status": "affected", "versionType": "semver" }, { "version": "6.12.70", "lessThan": "6.12.78", "status": "affected", "versionType": "semver" }, { "version": "6.18.10", "lessThan": "6.18.20", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/ti/wlcore/tx.c" ], "versions": [ { "version": "6.19", "status": "affected" }, { "version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.250", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.200", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.163", "versionEndExcluding": "6.1.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.124", "versionEndExcluding": "6.6.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.70", "versionEndExcluding": "6.12.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.10", "versionEndExcluding": "6.18.20" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99" }, { "url": "https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea" }, { "url": "https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f" }, { "url": "https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8" }, { "url": "https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610" }, { "url": "https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c" }, { "url": "https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c" }, { "url": "https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69" } ], "title": "wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom", "x_generator": { "engine": "bippy-1.2.0" } } } }