CVE-2026-31548

Vulnerability

Overview

CVE-2026-31548 is a use-after-free style race condition in the Linux kernel's cfg80211 wireless configuration subsystem. The bug occurs in the handling of Per Station Measurement Request (PMSR) operations. When a user-space application closes an nl80211 socket that originated a PMSR request, cfg80211_release_pmsr() sets the request's nl_portid to zero and schedules the pmsr_free_wk workqueue item to process the abort asynchronously [1]. If the wireless interface is concurrently torn down (via cfg80211_pmsr_wdev_down()) before that scheduled work runs, the function calls cfg80211_pmsr_process_abort() directly. However, the previously scheduled pmsr_free_wk remains pending and can later execute after the interface has already been removed from the driver [2].

Exploitation and

Impact

An attacker with local access and the ability to trigger both a PMSR request and an interface teardown can exploit this ordering race. Specifically, the attacker needs to open an nl80211 socket, initiate a PMSR measurement, and then rapidly close that socket while simultaneously removing the wireless interface (e.g., via a netlink NL80211_CMD_DEL_INTERFACE call). Because the pmsr_free_wk is not cancelled before the synchronous abort in cfg80211_pmsr_wdev_down(), the driver's abort_pmsr callback may be invoked on a torn-down, invalid interface object [3]. This can lead to undefined behavior, memory corruption, or a system crash (kernel panic). The CVSS v3 score of 7.8 reflects the high severity due to the potential for denial-of-service or privilege escalation from a local attacker [4].

Mitigation

The fix, merged into the Linux kernel, adds a synchronous cancel_work_sync() on pmsr_free_wk at the beginning of cfg80211_pmsr_wdev_down(), before the abort processing. This ensures that any pending or in-progress work is drained before the interface teardown proceeds, preventing the work from invoking the driver callback after the interface is gone [1][2]. The patch has been backported to multiple stable kernel branches. Users and distribution maintainers should apply the latest updates to their kernels.