PT-2026-34900 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-04-29 · CVE-2026-31548

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the cfg80211 component of the wifi subsystem. When an nl80211 socket originating a PMSR request is closed, the cfg80211 release pmsr() function sets the nl portid variable to zero and schedules pmsr free wk to process the abort asynchronously. If the interface is torn down before this work executes, cfg80211 pmsr wdev down() calls cfg80211 pmsr process abort() directly, but the pending pmsr free wk work item may still run after the interface is removed. This can lead to the driver's abort pmsr() callback operating on a torn-down interface, resulting in undefined behavior and potential crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31548

ECHO-50F6-B04F-1CF5

Affected Products

Linux Kernel

References · 17

• https://ubuntu.com/security/CVE-2026-31548 · Vendor Advisory
• https://git.kernel.org/stable/c/6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31548 · Security Note
• https://git.kernel.org/stable/c/a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31548 · Vendor Advisory
• https://git.kernel.org/stable/c/28d3551f8d8cb3aec7497894d94150fe84d20e5e · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31548 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31548 · Vendor Advisory
• https://git.kernel.org/stable/c/72b7ea786b8e570ae11149e9089859a4a8634a13 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31548 · Security Note
• https://git.kernel.org/stable/c/37e776e2e0a523731e2470dce6d563f0e8632a40 · Patch
• https://git.kernel.org/stable/c/d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31548 · Vendor Advisory
• https://twitter.com/CVEnew/status/2047798637108117527 · Twitter Post
• https://git.kernel.org/linus/6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09 · Note