CVE-2026-31552

Deeper analysis

CVE-2026-31552 is a vulnerability in the Linux kernel's wlcore WiFi driver, specifically affecting the wl1271_tx_allocate() and wl1271_prepare_tx_frame() functions. Following an upstream commit that ensures sufficient skb headroom before skb_push, these functions return -EAGAIN when pskb_expand_head() fails due to insufficient headroom. However, in wlcore_tx_work_locked(), this -EAGAIN is misinterpreted as the aggregation buffer being full, triggering a retry mechanism that flushes the buffer, requeues the skb, and loops indefinitely while holding wl->mutex and using GFP_ATOMIC allocations. This results in a CPU soft lockup, classified under CWE-835 (Loop with Unreachable Exit Condition), with a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

An attacker with network access to a system using the wlcore driver can exploit this remotely without privileges or user interaction by sending crafted packets that trigger the headroom failure. The low attack complexity allows exploitation over the network, leading to a denial-of-service condition via CPU soft lockup, as the infinite retry loop consumes CPU resources and prevents normal operation.

The provided kernel stable commit references detail the patches, which modify wl1271_tx_allocate() to return -ENOMEM instead of -EAGAIN on headroom failure. This ensures the packet is dropped, terminating the loop and avoiding the soft lockup.

This issue was identified by an experimental code review agent based on gemini-3.1-pro during review of backports into v6.18.y, highlighting AI-assisted vulnerability detection in kernel code. No real-world exploitation is reported as of the 2026-04-24 publication.