Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-31552

wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails. However, in wlcore_tx_work_locked(), a return value of -EAGAIN from wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being full. This causes the code to flush the buffer, put the skb back at the head of the queue, and immediately retry the same skb in a tight while loop. Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens immediately with GFP_ATOMIC, this will result in an infinite loop and a CPU soft lockup. Return -ENOMEM instead so the packet is dropped and the loop terminates. The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 88295a55fefe5414e64293638b6f7549646e58ed to < 980f793645540ca7a6318165cc12f49d5febeb99affected
  • cd89a4656c03f8db0c57350aaec69cd3cfaa3522 to < 12f9eef39e49716c763714bfda835a733d5f6deaaffected
  • 745a0810dbc96a0471e5f5e627ba1e978c3116d4 to < ceb46b40b021d21911ff8608ce4ed33c1264ad2faffected
  • b167312390fdd461c81ead516f2b0b44e83a9edb to < a6dc74209462c4fe5a88718d2f3a5286886081c8affected
  • 71de0b6e04bbee5575caf9a1e4d424e7dcc50018 to < cfa64e2b3717be1da7c4c1aff7268a009e8c1610affected
  • 689a7980e4788e13e766763d53569fb78dea2513 to < 46c670ff1ff466e5eccb3940f726586473dc053caffected
  • e75665dd096819b1184087ba5718bd93beafff51 to < f2c06d718a7b85cbc59ceaa2ff3f46b178ac709caffected
  • e75665dd096819b1184087ba5718bd93beafff51 to < deb353d9bb009638b7762cae2d0b6e8fdbb41a69affected
  • 5.10.250 to < 5.10.253affected
  • 5.15.200 to < 5.15.203affected
  • 6.1.163 to < 6.1.167affected
  • 6.6.124 to < 6.6.130affected
  • 6.12.70 to < 6.12.78affected
  • 6.18.10 to < 6.18.20affected

Linux Linux

Default version status: affected

  • 6.19affected
  • 0 to < 6.19unaffected
  • 5.10.253 to ≤ 5.10.*unaffected
  • 5.15.203 to ≤ 5.15.*unaffected
  • 6.1.167 to ≤ 6.1.*unaffected
  • 6.6.130 to ≤ 6.6.*unaffected
  • 6.12.78 to ≤ 6.12.*unaffected
  • 6.18.20 to ≤ 6.18.*unaffected
  • 6.19.10 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References