{"cve":"CVE-2026-31552","nvd":{"published":"2026-04-24T15:16:29.497","modified":"2026-06-17T10:33:57.827","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-835"],"references":["https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea","https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c","https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99","https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8","https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:33:09.003606135+00:00"},"epss":{"cve":"CVE-2026-31552","score":0.00501,"percentile":0.42936,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}