PT-2026-34904 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-04-29 · CVE-2026-31552

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the wifi wlcore component where the wl1271 tx allocate() and wl1271 prepare tx frame() functions return -EAGAIN when pskb expand head() fails due to insufficient headroom. The wlcore tx work locked() function interprets this -EAGAIN return value as a full aggregation buffer, leading it to flush the buffer and immediately retry the same socket buffer (skb) in a tight loop. Because this process occurs while holding wl->mutex and uses GFP ATOMIC for retries, it results in an infinite loop and a CPU soft lockup.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-31552

ECHO-2176-BE3E-0249

Affected Products

Linux Kernel

References · 19

• https://cve.org/CVERecord?id=CVE-2026-31552 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31552 · Vendor Advisory
• https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c · Patch
• https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31552 · Vendor Advisory
• https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31552 · Vendor Advisory
• https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31552 · Security Note
• https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea · Patch
• https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8 · Patch
• https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31552 · Vendor Advisory
• https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610 · Patch
• https://ubuntu.com/security/CVE-2026-31552 · Vendor Advisory