CVE-2026-31552

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31552", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.115Z", "datePublished": "2026-04-24T14:33:19.065Z", "dateUpdated": "2026-08-05T12:23:26.516Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:26.516Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote network traffic can cause an affected wlcore-backed host or embedded device to transmit packets through the vulnerable TX path, and an adjacent WiFi attacker can also trigger AP/P2P management/data transmissions. Scoring uses the highest reasonable deployment where the device is reachable over IP via WiFi.\nAC:L - Once `pskb_expand_head()` fails for an skb with insufficient headroom, the erroneous `-EAGAIN` handling deterministically requeues and immediately retries the same skb in a tight loop. There is no race to win, and traffic flooding can sustain the TX/allocation pressure.\nPR:N - An attacker does not need local credentials to induce network or WiFi-originated transmissions in a reachable AP/station/embedded deployment. The vulnerable driver path itself has no authentication or privilege check once packets are queued for transmission.\nUI:N - No victim user action is required after the affected WiFi interface is operating. Attacker-supplied traffic can trigger the transmit path automatically.\nS:U - The impact is confined to the same kernel and device security authority. There is no VM, IOMMU, or separate security-scope boundary crossing.\nC:N - The fixed bug is an error-code confusion that causes an infinite retry loop after allocation failure. The failing `pskb_expand_head()` leaves the skb unmodified and does not provide an information disclosure primitive.\nI:N - The bug does not corrupt memory or modify attacker-chosen data; it requeues the same skb and spins. No arbitrary write or control-flow primitive is exposed by this issue.\nA:H - The loop runs immediately under `wl->mutex` with `GFP_ATOMIC` retry and can cause a CPU soft lockup. This is a kernel-level availability failure and can hang or severely degrade affected systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ti/wlcore/tx.c"], "versions": [{"version": "88295a55fefe5414e64293638b6f7549646e58ed", "lessThan": "980f793645540ca7a6318165cc12f49d5febeb99", "status": "affected", "versionType": "git"}, {"version": "cd89a4656c03f8db0c57350aaec69cd3cfaa3522", "lessThan": "12f9eef39e49716c763714bfda835a733d5f6dea", "status": "affected", "versionType": "git"}, {"version": "745a0810dbc96a0471e5f5e627ba1e978c3116d4", "lessThan": "ceb46b40b021d21911ff8608ce4ed33c1264ad2f", "status": "affected", "versionType": "git"}, {"version": "b167312390fdd461c81ead516f2b0b44e83a9edb", "lessThan": "a6dc74209462c4fe5a88718d2f3a5286886081c8", "status": "affected", "versionType": "git"}, {"version": "71de0b6e04bbee5575caf9a1e4d424e7dcc50018", "lessThan": "cfa64e2b3717be1da7c4c1aff7268a009e8c1610", "status": "affected", "versionType": "git"}, {"version": "689a7980e4788e13e766763d53569fb78dea2513", "lessThan": "46c670ff1ff466e5eccb3940f726586473dc053c", "status": "affected", "versionType": "git"}, {"version": "e75665dd096819b1184087ba5718bd93beafff51", "lessThan": "f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c", "status": "affected", "versionType": "git"}, {"version": "e75665dd096819b1184087ba5718bd93beafff51", "lessThan": "deb353d9bb009638b7762cae2d0b6e8fdbb41a69", "status": "affected", "versionType": "git"}, {"version": "5.10.250", "lessThan": "5.10.253", "status": "affected", "versionType": "semver"}, {"version": "5.15.200", "lessThan": "5.15.203", "status": "affected", "versionType": "semver"}, {"version": "6.1.163", "lessThan": "6.1.167", "status": "affected", "versionType": "semver"}, {"version": "6.6.124", "lessThan": "6.6.130", "status": "affected", "versionType": "semver"}, {"version": "6.12.70", "lessThan": "6.12.78", "status": "affected", "versionType": "semver"}, {"version": "6.18.10", "lessThan": "6.18.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/ti/wlcore/tx.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.250", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.200", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.163", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.124", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.70", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.10", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99"}, {"url": "https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea"}, {"url": "https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"}, {"url": "https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8"}, {"url": "https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610"}, {"url": "https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c"}, {"url": "https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c"}, {"url": "https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"}], "title": "wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/ti/wlcore/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "980f793645540ca7a6318165cc12f49d5febeb99", "status": "affected", "version": "88295a55fefe5414e64293638b6f7549646e58ed", "versionType": "git"}, {"lessThan": "12f9eef39e49716c763714bfda835a733d5f6dea", "status": "affected", "version": "cd89a4656c03f8db0c57350aaec69cd3cfaa3522", "versionType": "git"}, {"lessThan": "ceb46b40b021d21911ff8608ce4ed33c1264ad2f", "status": "affected", "version": "745a0810dbc96a0471e5f5e627ba1e978c3116d4", "versionType": "git"}, {"lessThan": "a6dc74209462c4fe5a88718d2f3a5286886081c8", "status": "affected", "version": "b167312390fdd461c81ead516f2b0b44e83a9edb", "versionType": "git"}, {"lessThan": "cfa64e2b3717be1da7c4c1aff7268a009e8c1610", "status": "affected", "version": "71de0b6e04bbee5575caf9a1e4d424e7dcc50018", "versionType": "git"}, {"lessThan": "46c670ff1ff466e5eccb3940f726586473dc053c", "status": "affected", "version": "689a7980e4788e13e766763d53569fb78dea2513", "versionType": "git"}, {"lessThan": "f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c", "status": "affected", "version": "e75665dd096819b1184087ba5718bd93beafff51", "versionType": "git"}, {"lessThan": "deb353d9bb009638b7762cae2d0b6e8fdbb41a69", "status": "affected", "version": "e75665dd096819b1184087ba5718bd93beafff51", "versionType": "git"}, {"lessThan": "5.10.253", "status": "affected", "version": "5.10.250", "versionType": "semver"}, {"lessThan": "5.15.203", "status": "affected", "version": "5.15.200", "versionType": "semver"}, {"lessThan": "6.1.167", "status": "affected", "version": "6.1.163", "versionType": "semver"}, {"lessThan": "6.6.130", "status": "affected", "version": "6.6.124", "versionType": "semver"}, {"lessThan": "6.12.78", "status": "affected", "version": "6.12.70", "versionType": "semver"}, {"lessThan": "6.18.20", "status": "affected", "version": "6.18.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/ti/wlcore/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "66E4302C-5EB9-4984-983B-20CA9FFA4B97", "versionEndExcluding": "5.10.253", "versionStartIncluding": "5.10.250", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "63DFD51E-A9F5-4387-ABA4-525154CD3972", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.15.200", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "73CD421D-F2A3-4142-A9A2-47683BB9ABD4", "versionEndExcluding": "6.1.167", "versionStartIncluding": "6.1.163", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1C9B72D-1F0E-488D-AE95-ADE16C092AF0", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.6.124", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0126FC39-C23D-40D2-BC7F-4692652C4520", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12.70", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3BAA8AC-B2CC-40BC-AFBE-379025E7EF3D", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.18.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nwifi: wlcore: Devolver -ENOMEM en lugar de -EAGAIN si no hay suficiente espacio de cabecera (headroom)\n\nDesde el commit upstream e75665dd0968 (\u2019wifi: wlcore: ensure skb headroom before skb_push\u2019), wl1271_tx_allocate() y con ello wl1271_prepare_tx_frame() devuelven -EAGAIN si pskb_expand_head() falla. Sin embargo, en wlcore_tx_work_locked(), un valor de retorno de -EAGAIN de wl1271_prepare_tx_frame() se interpreta como que el b\u00fafer de agregaci\u00f3n est\u00e1 lleno. Esto hace que el c\u00f3digo vac\u00ede el b\u00fafer, coloque el skb de nuevo al principio de la cola e intente inmediatamente el mismo skb en un bucle \u2019while\u2019 ajustado.\n\nDebido a que wlcore_tx_work_locked() mantiene wl -> mutex, y el reintento ocurre inmediatamente con GFP_ATOMIC, esto resultar\u00e1 en un bucle infinito y un bloqueo suave de la CPU (CPU soft lockup). Devolver -ENOMEM en su lugar para que el paquete se descarte y el bucle termine.\n\nEl problema fue encontrado por un agente experimental de revisi\u00f3n de c\u00f3digo basado en gemini-3.1-pro mientras revisaba backports en v6.18.y."}], "id": "CVE-2026-31552", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-24T15:16:29.497", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom", "id": "2461490", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461490"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in the Linux kernel's wlcore component. When the system attempts to allocate memory for a network packet and there is insufficient space, an incorrect error code is returned. This error handling issue causes the system to repeatedly attempt to process the same packet in an endless loop, leading to a CPU soft lockup. This can result in a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-31552", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31552\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31552\nhttps://lore.kernel.org/linux-cve-announce/2026042427-CVE-2026-31552-505c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88295a55fefe5414e64293638b6f7549646e58ed,980f793645540ca7a6318165cc12f49d5febeb99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd89a4656c03f8db0c57350aaec69cd3cfaa3522,12f9eef39e49716c763714bfda835a733d5f6dea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[745a0810dbc96a0471e5f5e627ba1e978c3116d4,ceb46b40b021d21911ff8608ce4ed33c1264ad2f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b167312390fdd461c81ead516f2b0b44e83a9edb,a6dc74209462c4fe5a88718d2f3a5286886081c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[71de0b6e04bbee5575caf9a1e4d424e7dcc50018,cfa64e2b3717be1da7c4c1aff7268a009e8c1610)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[689a7980e4788e13e766763d53569fb78dea2513,46c670ff1ff466e5eccb3940f726586473dc053c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e75665dd096819b1184087ba5718bd93beafff51,f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e75665dd096819b1184087ba5718bd93beafff51,deb353d9bb009638b7762cae2d0b6e8fdbb41a69)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T06:45:03.731297+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the fix which returns -ENOMEM instead of -EAGAIN when headroom is insufficient", "If a kernel update is not immediately possible, quarantine the affected Wi\u2011Fi adapter or limit traffic to prevent the allocation failure from occurring", "Monitor the system for signs of CPU soft lockup and reboot promptly should the driver enter a lockup state"], "summary": {"action": "Immediate Patch", "impact": "Denial of Service through CPU soft lockup"}, "threat_synthesis": {"affected_systems": "This issue affects the Linux kernel for versions 6.19 and the 7.0 release candidates 1 through 7. The patch that fixes the bug is present in later revisions of the 6.18.y backport series and is expected to be merged into the mainline.", "description_and_impact": "The vulnerability resides in the Linux wireless driver wlcore: when a transmit packet fails to allocate sufficient headroom, the driver mistakenly interprets the failure as a full aggregation buffer. The code then enters a tight retry loop while holding wl->mutex and using atomic allocation, resulting in an infinite CPU\u2011tight loop and a soft lockup of the kernel. The primary effect is a denial of service that can degrade system responsiveness and stability. The weakness is a classic infinite loop (CWE\u2011835).", "risk_and_exploitability": "With a CVSS score of 7.5 the vulnerability is considered moderately high severity, yet its EPSS score is less than 1% and it is not listed in the CISA KEV catalog, indicating low prior exploitation activity. The likely attack vector is the reception of wireless traffic that triggers a failure in headroom allocation; while the description does not state explicit prerequisites, it can be inferred that an attacker can potentially craft traffic to induce the failure without special privileges, resulting in the infinite loop. Cloud or local Wi\u2011Fi\u2011enabled systems remain at risk until the patch is applied."}}}}, "created": "2026-04-27T19:15:11.618184+00:00", "updated": "2026-04-28T06:45:24.302427+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}