VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/31xxx/CVE-2026-31552.json
T

300 lines
16 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-31552",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2026-03-09T15:48:24.115Z",
"datePublished": "2026-04-24T14:33:19.065Z",
"dateUpdated": "2026-08-05T12:23:26.516Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T12:23:26.516Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote network traffic can cause an affected wlcore-backed host or embedded device to transmit packets through the vulnerable TX path, and an adjacent WiFi attacker can also trigger AP/P2P management/data transmissions. Scoring uses the highest reasonable deployment where the device is reachable over IP via WiFi.\nAC:L - Once `pskb_expand_head()` fails for an skb with insufficient headroom, the erroneous `-EAGAIN` handling deterministically requeues and immediately retries the same skb in a tight loop. There is no race to win, and traffic flooding can sustain the TX/allocation pressure.\nPR:N - An attacker does not need local credentials to induce network or WiFi-originated transmissions in a reachable AP/station/embedded deployment. The vulnerable driver path itself has no authentication or privilege check once packets are queued for transmission.\nUI:N - No victim user action is required after the affected WiFi interface is operating. Attacker-supplied traffic can trigger the transmit path automatically.\nS:U - The impact is confined to the same kernel and device security authority. There is no VM, IOMMU, or separate security-scope boundary crossing.\nC:N - The fixed bug is an error-code confusion that causes an infinite retry loop after allocation failure. The failing `pskb_expand_head()` leaves the skb unmodified and does not provide an information disclosure primitive.\nI:N - The bug does not corrupt memory or modify attacker-chosen data; it requeues the same skb and spins. No arbitrary write or control-flow primitive is exposed by this issue.\nA:H - The loop runs immediately under `wl->mutex` with `GFP_ATOMIC` retry and can cause a CPU soft lockup. This is a kernel-level availability failure and can hang or severely degrade affected systems."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/net/wireless/ti/wlcore/tx.c"
],
"versions": [
{
"version": "88295a55fefe5414e64293638b6f7549646e58ed",
"lessThan": "980f793645540ca7a6318165cc12f49d5febeb99",
"status": "affected",
"versionType": "git"
},
{
"version": "cd89a4656c03f8db0c57350aaec69cd3cfaa3522",
"lessThan": "12f9eef39e49716c763714bfda835a733d5f6dea",
"status": "affected",
"versionType": "git"
},
{
"version": "745a0810dbc96a0471e5f5e627ba1e978c3116d4",
"lessThan": "ceb46b40b021d21911ff8608ce4ed33c1264ad2f",
"status": "affected",
"versionType": "git"
},
{
"version": "b167312390fdd461c81ead516f2b0b44e83a9edb",
"lessThan": "a6dc74209462c4fe5a88718d2f3a5286886081c8",
"status": "affected",
"versionType": "git"
},
{
"version": "71de0b6e04bbee5575caf9a1e4d424e7dcc50018",
"lessThan": "cfa64e2b3717be1da7c4c1aff7268a009e8c1610",
"status": "affected",
"versionType": "git"
},
{
"version": "689a7980e4788e13e766763d53569fb78dea2513",
"lessThan": "46c670ff1ff466e5eccb3940f726586473dc053c",
"status": "affected",
"versionType": "git"
},
{
"version": "e75665dd096819b1184087ba5718bd93beafff51",
"lessThan": "f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c",
"status": "affected",
"versionType": "git"
},
{
"version": "e75665dd096819b1184087ba5718bd93beafff51",
"lessThan": "deb353d9bb009638b7762cae2d0b6e8fdbb41a69",
"status": "affected",
"versionType": "git"
},
{
"version": "5.10.250",
"lessThan": "5.10.253",
"status": "affected",
"versionType": "semver"
},
{
"version": "5.15.200",
"lessThan": "5.15.203",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.1.163",
"lessThan": "6.1.167",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.6.124",
"lessThan": "6.6.130",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.12.70",
"lessThan": "6.12.78",
"status": "affected",
"versionType": "semver"
},
{
"version": "6.18.10",
"lessThan": "6.18.20",
"status": "affected",
"versionType": "semver"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/net/wireless/ti/wlcore/tx.c"
],
"versions": [
{
"version": "6.19",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.19",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.253",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.203",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.167",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.130",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.78",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.18.20",
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.19.10",
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.250",
"versionEndExcluding": "5.10.253"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.200",
"versionEndExcluding": "5.15.203"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.163",
"versionEndExcluding": "6.1.167"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.124",
"versionEndExcluding": "6.6.130"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.70",
"versionEndExcluding": "6.12.78"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.18.10",
"versionEndExcluding": "6.18.20"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.10"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.0"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99"
},
{
"url": "https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea"
},
{
"url": "https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"
},
{
"url": "https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8"
},
{
"url": "https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610"
},
{
"url": "https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c"
},
{
"url": "https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c"
},
{
"url": "https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"
}
],
"title": "wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
}
}
View Git Blame Copy Permalink