CVE-2026-31548: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31548 is a race condition vulnerability in the Linux kernel's wifi: cfg80211 PMSR (Peer Measurement Request) subsystem. When an nl80211 socket that originated a PMSR request is closed, the kernel schedules pmsr_free_wk to process the abort asynchronously; if the wireless interface is concurrently torn down before this work executes, the pending work item may run after the interface has been removed from the driver, leading to undefined behavior or kernel crashes. The vulnerability affects Linux kernel versions 5.0 through 6.1.166, 6.2 through 6.6.129, 6.7 through 6.12.77, 6.13 through 6.18.19, and 6.19 through 6.19.9. It was published on April 24, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is a race condition within a thread (CWE-366 / CAPEC-26: Leveraging Race Conditions) in the cfg80211 wireless subsystem. When cfg80211_release_pmsr() is called upon nl80211 socket closure, it sets nl_portid to zero and schedules pmsr_free_wk for asynchronous abort processing. If cfg80211_pmsr_wdev_down() is invoked concurrently during interface teardown, it calls cfg80211_pmsr_process_abort() directly but does not cancel the already-queued work item, leaving pmsr_free_wk able to fire after the interface is gone and invoke the driver's abort_pmsr callback on a torn-down interface. The fix cancels pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down() before calling cfg80211_pmsr_process_abort(), ensuring all pending work is drained prior to interface teardown (Red Hat CVE, kernel.org patch).

A local attacker with low privileges can trigger this race condition by closing an nl80211 socket while concurrently removing a wireless interface, potentially causing the kernel's abort_pmsr driver callback to operate on a torn-down interface. The primary impact is a denial of service via kernel crash or undefined behavior; the CVSS score also reflects potential high confidentiality and integrity impacts due to the nature of kernel-level memory corruption that can accompany such race conditions. Systems with wireless functionality running affected kernel versions are at risk, though exploitation requires local access (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and the ability to time concurrent nl80211 socket closure with wireless interface teardown, making opportunistic exploitation unlikely.

Update the Linux kernel to a patched version corresponding to your current branch: 6.1.167 or later, 6.6.130 or later, 6.12.78 or later, 6.18.20 or later, or 6.19.10 or later. The fix is also included in kernel 7.0. No configuration-based workaround is available; upgrading to a patched kernel is the only remediation. Systems that do not use wireless (nl80211/cfg80211) functionality are not exposed to this code path (Red Hat CVE, kernel.org patch).

Red Hat has acknowledged the vulnerability and assigned it a Medium severity estimate, tracking it via Bugzilla (Red Hat Bugzilla). The Yocto Project security mailing list has also referenced the CVE in the context of embedded Linux security updates (Yocto Security List). No significant broader community or media commentary has been identified beyond standard vulnerability tracking.