CVE-2026-31506: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31506 is a double free vulnerability in the Linux kernel's bcmasp network driver component, specifically in the handling of the Wake-on-LAN (WoL) interrupt request (irq). The flaw arises because the driver unnecessarily calls a manual free on wol_irq, which was already registered via devm_request_irq() and is automatically managed by the kernel's device resource manager (devres). Affected kernel versions include 6.6.1 through 6.12.79, 6.13 through 6.18.20, and 6.19 through 6.19.10, as well as 7.0 release candidates. It was published on April 22, 2026, with patches released by April 28, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-415 (Double Free) and CWE-1341 (Multiple Releases of Same Resource or Handle). The bcmasp driver incorrectly calls a manual deallocation on the wol_irq interrupt resource that was originally allocated with devm_request_irq(), a managed resource API that automatically releases resources when the device is unbound or the driver is unloaded. This results in the same memory being freed twice, corrupting kernel heap metadata. Exploitation requires local access with low privileges — an attacker or process that can trigger driver reload or WoL-related code paths (e.g., by manipulating network interface state) could trigger the double free condition (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation of this double free vulnerability can lead to kernel memory corruption, potentially resulting in a denial of service (system crash/kernel panic) or, in more severe scenarios, arbitrary code execution in kernel context. Given the local attack vector, a compromised low-privileged user account or process on an affected system could escalate privileges or destabilize the host. Systems with Wake-on-LAN enabled or those that frequently reload the bcmasp driver are at elevated risk (GitHub Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.018% (roughly the 3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat Bugzilla).

Patches have been released for all affected Linux kernel stable branches. Updated versions include 6.12.80, 6.18.21, 6.19.11, and 7.0 (stable). The specific fixing commits are 121a6ad9cd42ba3bfc57deae93e3326515c2afe1, 8a30509ce6a29bdf18e0802383c524a7b2357ec0, 9e5f5c07cc7d66522f8c9676c28605eba5d4a20e, and cbfa5be2bf64511d49b854a0f9fd6d0b5118621f. As a workaround where patching is not immediately possible, consider disabling Wake-on-LAN functionality on affected interfaces and restricting local user access to minimize exposure. Prioritize patching on systems running the bcmasp driver with WoL enabled (GitHub Advisory, Red Hat Bugzilla).