CVE-2026-31552: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31552 is a logic error (infinite loop) vulnerability in the Linux kernel's wlcore WiFi driver that can cause a CPU soft lockup and system unresponsiveness. The flaw was introduced after upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push") and affects multiple stable kernel branches. Affected versions include Linux kernel 5.10.250–5.10.252, 5.15.200–5.15.202, 6.1.163–6.1.166, 6.6.124–6.6.129, 6.12.70–6.12.77, 6.18.10–6.18.19, 6.19.1–6.19.9, and 7.0-rc1 through rc7. It was published on April 24, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Feedly).

The root cause is a logic error (CWE-835: Loop with Unreachable Exit Condition) in wlcore_tx_work_locked(). After commit e75665dd0968, wl1271_tx_allocate() returns -EAGAIN when pskb_expand_head() fails due to insufficient memory. However, wlcore_tx_work_locked() interprets -EAGAIN as a signal that the aggregation buffer is full — not a memory failure — causing it to flush the buffer, re-queue the same socket buffer (skb), and immediately retry in a tight while loop. Because the function holds wl->mutex throughout and retries with GFP_ATOMIC (which cannot sleep or reclaim memory), the loop never exits, resulting in a CPU soft lockup. The fix changes the return value to -ENOMEM so the packet is dropped and the loop terminates. The bug was discovered by an experimental AI-based code review agent (gemini-3.1-pro) during backport review into v6.18.y (Red Hat Advisory).

Successful triggering of this vulnerability causes an infinite loop in the kernel's WiFi transmit path, resulting in a CPU soft lockup and complete system unresponsiveness on affected devices. The impact is limited to availability — there is no confidentiality or integrity compromise. Systems using the wlcore WiFi driver (e.g., devices with TI WL12xx/WL18xx chipsets) under memory pressure during packet transmission are at risk of becoming fully unresponsive until rebooted (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Triggering the bug requires local or network conditions that cause memory allocation failure (pskb_expand_head()) during WiFi packet transmission on a device using the wlcore driver (Red Hat Advisory, Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing soft lockup - CPU#X stuck for Xs! messages, particularly associated with wlcore_tx_work_locked or wl1271 stack traces.
• Process/System Behavior: System becomes unresponsive or freezes during active WiFi usage on devices with TI wlcore-based chipsets; watchdog timer triggers visible in kernel ring buffer.
• Network: Sudden cessation of WiFi traffic from the affected device coinciding with high CPU utilization on a single core.

Apply the patched Linux kernel versions: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.78+, 6.18.20+, 6.19.10+, or the 7.0 stable release. Patches are available in the stable kernel repositories at git.kernel.org. As a temporary workaround for systems that cannot be immediately patched, reducing memory pressure on devices using the wlcore driver or disabling WiFi on affected hardware can mitigate the risk. Red Hat has tracked this issue in their bugzilla (Red Hat Bugzilla, Red Hat Advisory). Debian has also released updated packages incorporating the fix (Debian Tracker).

The vulnerability was noted in the Yocto Project security mailing list as part of routine kernel CVE tracking. Red Hat tracked it via their bugzilla system. No significant public researcher commentary or media coverage has been identified beyond standard CVE tracking channels (Yocto Security List).