CVE-2026-31661: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31661 is a DMA memory management flaw in the Linux kernel's brcmsmac WiFi driver, classified as a Release of Invalid Pointer or Reference (CWE-763). The vulnerability arises because dma_alloc_consistent() may align and change the allocated memory size (storing the result in alloced), but the corresponding dma_free_coherent() call uses the original, unaligned size — creating a size mismatch during deallocation. It affects Linux kernel versions from 3.2.1 through multiple stable branches prior to their respective fixes. The vulnerability was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect size parameter passed to dma_free_coherent() in the brcmsmac WiFi driver (CWE-763: Release of Invalid Pointer or Reference). When dma_alloc_consistent() aligns the requested allocation size, it stores the actual (aligned) size in the alloced field; however, the driver's deallocation path uses the original unaligned size instead of alloced, causing a mismatch between allocated and freed memory regions. This is a local vulnerability requiring low privileges and no user interaction, exploitable only by a user with local system access. The fix, applied across multiple stable kernel trees, corrects the dma_free_coherent() call to use the size stored in alloced (GitHub Advisory, Feedly).

Successful exploitation can cause kernel memory corruption, system instability, and denial of service through kernel crashes or hangs when the brcmsmac WiFi driver attempts to free an incorrectly sized DMA memory region. The impact is limited to availability — there are no confidentiality or integrity impacts expected. The vulnerability is scoped to the local system and does not provide a pathway for remote code execution or lateral movement (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface.

Apply the available kernel patches for the relevant stable branch. Fixed versions include: 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, and 6.19.13, as well as the 7.0 release (GitHub Advisory, Feedly). Systems actively using the brcmsmac WiFi driver should be prioritized for patching. As a secondary measure, restrict local user privileges where possible to reduce the attack surface until patching can be completed.