PT-2026-34903 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-04-29 · CVE-2026-31551

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mac80211 wifi component where the aql enable write() function does not serialize concurrent writes to the debugfs. This can lead to a static branch dec() underflow for aql disable because the state may change between the call to static key false(&aql disable.key) and the subsequent call to static branch inc() or static branch dec().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-31551

ECHO-3CBB-3B05-CEE0

Affected Products

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/8bb90ff77326c34e75b573b1febdd9586fec5aba · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31551 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31551 · Vendor Advisory
• https://git.kernel.org/stable/c/787152497ac763deab16f6f4b7ce79aaeb3eb7e8 · Patch
• https://git.kernel.org/stable/c/29a1a350afcd28a2150bd73b8bd83eac3480f13e · Patch
• https://git.kernel.org/stable/c/b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31551 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31551 · Vendor Advisory
• https://git.kernel.org/stable/c/b24763d32d5b4ada766deca4b42d6766272fef0c · Patch
• https://git.kernel.org/stable/c/5ba05436f15d16ae7ab04b880e8bf8d440be892b · Patch
• https://git.kernel.org/stable/c/256f7d4c11235d0569f78413c41dc89d2dc1557c · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31551 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31551 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31551 · Security Note
• https://twitter.com/CVEnew/status/2047798634272678008 · Twitter Post