{"id":"CVE-2026-31552","state":"PUBLISHED","title":"wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y.","publishedAt":"2026-04-24T14:33:19.065Z","updatedAt":"2026-08-05T12:23:26.516Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"88295a55fefe5414e64293638b6f7549646e58ed","status":"affected","lessThan":"980f793645540ca7a6318165cc12f49d5febeb99","versionType":"git"},{"version":"cd89a4656c03f8db0c57350aaec69cd3cfaa3522","status":"affected","lessThan":"12f9eef39e49716c763714bfda835a733d5f6dea","versionType":"git"},{"version":"745a0810dbc96a0471e5f5e627ba1e978c3116d4","status":"affected","lessThan":"ceb46b40b021d21911ff8608ce4ed33c1264ad2f","versionType":"git"},{"version":"b167312390fdd461c81ead516f2b0b44e83a9edb","status":"affected","lessThan":"a6dc74209462c4fe5a88718d2f3a5286886081c8","versionType":"git"},{"version":"71de0b6e04bbee5575caf9a1e4d424e7dcc50018","status":"affected","lessThan":"cfa64e2b3717be1da7c4c1aff7268a009e8c1610","versionType":"git"},{"version":"689a7980e4788e13e766763d53569fb78dea2513","status":"affected","lessThan":"46c670ff1ff466e5eccb3940f726586473dc053c","versionType":"git"},{"version":"e75665dd096819b1184087ba5718bd93beafff51","status":"affected","lessThan":"f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c","versionType":"git"},{"version":"e75665dd096819b1184087ba5718bd93beafff51","status":"affected","lessThan":"deb353d9bb009638b7762cae2d0b6e8fdbb41a69","versionType":"git"},{"version":"5.10.250","status":"affected","lessThan":"5.10.253","versionType":"semver"},{"version":"5.15.200","status":"affected","lessThan":"5.15.203","versionType":"semver"},{"version":"6.1.163","status":"affected","lessThan":"6.1.167","versionType":"semver"},{"version":"6.6.124","status":"affected","lessThan":"6.6.130","versionType":"semver"},{"version":"6.12.70","status":"affected","lessThan":"6.12.78","versionType":"semver"},{"version":"6.18.10","status":"affected","lessThan":"6.18.20","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.20","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.10","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"]}],"references":["https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99","https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea","https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f","https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8","https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610","https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c","https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c","https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31552.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31552","state":"PUBLISHED","datePublished":"2026-04-24T14:33:19.065Z","dateUpdated":"2026-08-05T12:23:26.516Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.115Z"},"containers":{"cna":{"title":"wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"88295a55fefe5414e64293638b6f7549646e58ed","status":"affected","lessThan":"980f793645540ca7a6318165cc12f49d5febeb99","versionType":"git"},{"version":"cd89a4656c03f8db0c57350aaec69cd3cfaa3522","status":"affected","lessThan":"12f9eef39e49716c763714bfda835a733d5f6dea","versionType":"git"},{"version":"745a0810dbc96a0471e5f5e627ba1e978c3116d4","status":"affected","lessThan":"ceb46b40b021d21911ff8608ce4ed33c1264ad2f","versionType":"git"},{"version":"b167312390fdd461c81ead516f2b0b44e83a9edb","status":"affected","lessThan":"a6dc74209462c4fe5a88718d2f3a5286886081c8","versionType":"git"},{"version":"71de0b6e04bbee5575caf9a1e4d424e7dcc50018","status":"affected","lessThan":"cfa64e2b3717be1da7c4c1aff7268a009e8c1610","versionType":"git"},{"version":"689a7980e4788e13e766763d53569fb78dea2513","status":"affected","lessThan":"46c670ff1ff466e5eccb3940f726586473dc053c","versionType":"git"},{"version":"e75665dd096819b1184087ba5718bd93beafff51","status":"affected","lessThan":"f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c","versionType":"git"},{"version":"e75665dd096819b1184087ba5718bd93beafff51","status":"affected","lessThan":"deb353d9bb009638b7762cae2d0b6e8fdbb41a69","versionType":"git"},{"version":"5.10.250","status":"affected","lessThan":"5.10.253","versionType":"semver"},{"version":"5.15.200","status":"affected","lessThan":"5.15.203","versionType":"semver"},{"version":"6.1.163","status":"affected","lessThan":"6.1.167","versionType":"semver"},{"version":"6.6.124","status":"affected","lessThan":"6.6.130","versionType":"semver"},{"version":"6.12.70","status":"affected","lessThan":"6.12.78","versionType":"semver"},{"version":"6.18.10","status":"affected","lessThan":"6.18.20","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.130","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.78","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.20","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.10","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99"},{"url":"https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea"},{"url":"https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"},{"url":"https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8"},{"url":"https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610"},{"url":"https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c"},{"url":"https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c"},{"url":"https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - Remote network traffic can cause an affected wlcore-backed host or embedded device to transmit packets through the vulnerable TX path, and an adjacent WiFi attacker can also trigger AP/P2P management/data transmissions. Scoring uses the highest reasonable deployment where the device is reachable over IP via WiFi.\nAC:L - Once `pskb_expand_head()` fails for an skb with insufficient headroom, the erroneous `-EAGAIN` handling deterministically requeues and immediately retries the same skb in a tight loop. There is no race to win, and traffic flooding can sustain the TX/allocation pressure.\nPR:N - An attacker does not need local credentials to induce network or WiFi-originated transmissions in a reachable AP/station/embedded deployment. The vulnerable driver path itself has no authentication or privilege check once packets are queued for transmission.\nUI:N - No victim user action is required after the affected WiFi interface is operating. Attacker-supplied traffic can trigger the transmit path automatically.\nS:U - The impact is confined to the same kernel and device security authority. There is no VM, IOMMU, or separate security-scope boundary crossing.\nC:N - The fixed bug is an error-code confusion that causes an infinite retry loop after allocation failure. The failing `pskb_expand_head()` leaves the skb unmodified and does not provide an information disclosure primitive.\nI:N - The bug does not corrupt memory or modify attacker-chosen data; it requeues the same skb and spins. No arbitrary write or control-flow primitive is exposed by this issue.\nA:H - The loop runs immediately under `wl->mutex` with `GFP_ATOMIC` retry and can cause a CPU soft lockup. This is a kernel-level availability failure and can hang or severely degrade affected systems."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:23:26.516Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.250","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.200","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.163","versionEndExcluding":"6.1.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.124","versionEndExcluding":"6.6.130"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.70","versionEndExcluding":"6.12.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.10","versionEndExcluding":"6.18.20"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"6.19.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}