CVE-2026-31661

Vulnerability

CVE-2026-31661 is a bug in the Linux kernel's brcmsmac wireless driver. The issue arises because dma_alloc_coherent() may adjust the requested allocation size to meet alignment requirements, and the driver saves this adjusted size in the alloced field. However, but then uses the original, unaligned size when calling dma_free_coherent(). This mismatch can lead to freeing the wrong amount of memory, potentially causing memory corruption or a use-after-free condition.

Exploitation

An attacker would need to be able to trigger the affected code path in the brcmsmac driver, which typically requires local access to the system and the ability to interact with the wireless interface. No special privileges beyond normal user access to the network subsystem are likely required, but the attack surface is limited to systems using the Broadcom wireless chipsets supported by this driver.

Impact

Successful exploitation could result in memory corruption, leading to system instability or a denial of service. In some cases, it might be leveraged for privilege escalation if the corruption affects kernel memory in a controlled way, though the CVE description does not specify such a scenario.

Mitigation

The fix is included in the Linux kernel stable tree via commits [1], [2], [3], and [4]. Users should update their kernel to a version containing the patch. No workaround is mentioned, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication.