CVE-2026-31552

wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom

State: Published
Severity: 7.5 High
Published: Apr 24, 2026
Updated: Aug 5, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom

Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails. However, in wlcore_tx_work_locked(), a return value of -EAGAIN from wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being full. This causes the code to flush the buffer, put the skb back at the head of the queue, and immediately retry the same skb in a tight while loop.

Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens immediately with GFP_ATOMIC, this will result in an infinite loop and a CPU soft lockup. Return -ENOMEM instead so the packet is dropped and the loop terminates.

The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	88295a55fefe5414e64293638b6f7549646e58ed to before 980f793645540ca7a6318165cc12f49d5febeb99Affected cd89a4656c03f8db0c57350aaec69cd3cfaa3522 to before 12f9eef39e49716c763714bfda835a733d5f6deaAffected 745a0810dbc96a0471e5f5e627ba1e978c3116d4 to before ceb46b40b021d21911ff8608ce4ed33c1264ad2fAffected b167312390fdd461c81ead516f2b0b44e83a9edb to before a6dc74209462c4fe5a88718d2f3a5286886081c8Affected 71de0b6e04bbee5575caf9a1e4d424e7dcc50018 to before cfa64e2b3717be1da7c4c1aff7268a009e8c1610Affected 689a7980e4788e13e766763d53569fb78dea2513 to before 46c670ff1ff466e5eccb3940f726586473dc053cAffected e75665dd096819b1184087ba5718bd93beafff51 to before f2c06d718a7b85cbc59ceaa2ff3f46b178ac709cAffected e75665dd096819b1184087ba5718bd93beafff51 to before deb353d9bb009638b7762cae2d0b6e8fdbb41a69Affected 5.10.250 to before 5.10.253Affected 5.15.200 to before 5.15.203Affected 6.1.163 to before 6.1.167Affected 6.6.124 to before 6.6.130Affected 6.12.70 to before 6.12.78Affected 6.18.10 to before 6.18.20Affected
LinuxLinux	6.19Affected before 6.19Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.20 through 6.18.Not affected 6.19.10 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

88295a55fefe5414e64293638b6f7549646e58ed to before 980f793645540ca7a6318165cc12f49d5febeb99Affected
cd89a4656c03f8db0c57350aaec69cd3cfaa3522 to before 12f9eef39e49716c763714bfda835a733d5f6deaAffected
745a0810dbc96a0471e5f5e627ba1e978c3116d4 to before ceb46b40b021d21911ff8608ce4ed33c1264ad2fAffected
b167312390fdd461c81ead516f2b0b44e83a9edb to before a6dc74209462c4fe5a88718d2f3a5286886081c8Affected
71de0b6e04bbee5575caf9a1e4d424e7dcc50018 to before cfa64e2b3717be1da7c4c1aff7268a009e8c1610Affected
689a7980e4788e13e766763d53569fb78dea2513 to before 46c670ff1ff466e5eccb3940f726586473dc053cAffected
e75665dd096819b1184087ba5718bd93beafff51 to before f2c06d718a7b85cbc59ceaa2ff3f46b178ac709cAffected
e75665dd096819b1184087ba5718bd93beafff51 to before deb353d9bb009638b7762cae2d0b6e8fdbb41a69Affected
5.10.250 to before 5.10.253Affected
5.15.200 to before 5.15.203Affected
6.1.163 to before 6.1.167Affected
6.6.124 to before 6.6.130Affected
6.12.70 to before 6.12.78Affected
6.18.10 to before 6.18.20Affected

LinuxLinux

6.19Affected
before 6.19Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.20 through 6.18.*Not affected
6.19.10 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.