CVE-2026-31548: Linux Kernel Race Condition Vulnerability

CVE-2026-31548 Overview

CVE-2026-31548 is a race condition vulnerability in the Linux kernel's cfg80211 wireless subsystem. The flaw resides in the Peer Measurement (PMSR) handling code, specifically in cfg80211_pmsr_wdev_down(). When an nl80211 socket that initiated a PMSR request closes, the kernel schedules pmsr_free_wk to handle the abort asynchronously. If the interface is torn down concurrently, the pending work item can execute after the interface is gone, causing the driver's abort_pmsr callback to operate on a destroyed interface. The resulting undefined behavior can lead to memory corruption and kernel crashes on affected systems.

Critical Impact
A local attacker with the ability to open nl80211 sockets and trigger wireless interface teardown can race the kernel into invoking driver callbacks against freed interface state, enabling denial of service and potential local privilege escalation.

Affected Products

Linux Kernel (mainline, multiple stable branches)
Linux Kernel 5.0 and later releases containing cfg80211 PMSR support
Linux Kernel 7.0 release candidates rc1 through rc7

Discovery Timeline

2026-04-24 - CVE-2026-31548 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31548

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in the cfg80211 Peer Measurement (PMSR) subsystem used by nl80211 for Wi-Fi ranging operations such as Fine Timing Measurement (FTM). The kernel uses two asynchronous paths to clean up an outstanding PMSR request, and these paths can interleave in a way that leaves stale work pending after interface teardown.

When the originating nl80211 socket closes, cfg80211_release_pmsr() sets the request's nl_portid to zero and schedules pmsr_free_wk to abort the measurement asynchronously. If the underlying wireless interface is concurrently torn down, cfg80211_pmsr_wdev_down() calls cfg80211_pmsr_process_abort() directly to clean up. The previously scheduled pmsr_free_wk work item, however, remains pending in the workqueue. Once it runs, it can invoke the driver's abort_pmsr callback against an interface that has already been removed from the driver, producing a use-after-free condition on wireless_dev state.

Root Cause

The root cause is missing synchronization between the asynchronous PMSR release path and the synchronous interface teardown path. cfg80211_pmsr_wdev_down() did not drain or cancel pmsr_free_wk before proceeding with teardown, leaving a window where the workqueue worker could execute against a destroyed struct wireless_dev. The fix cancels pmsr_free_wk synchronously inside cfg80211_pmsr_wdev_down() before calling cfg80211_pmsr_process_abort(), ensuring any pending or in-progress worker is drained before the interface is removed.

Attack Vector

Exploitation requires local access and the ability to interact with the nl80211 netlink interface. An attacker with sufficient privileges to issue PMSR requests opens an nl80211 socket, starts a peer measurement, then induces a race by closing the socket while concurrently bringing the wireless interface down. Repeated attempts to win the race can trigger driver callbacks on torn-down state, resulting in kernel memory corruption, crashes, or potential escalation depending on driver behavior. No user interaction or network-facing exposure is required.

No verified public proof-of-concept code is available. See the upstream commits in the Patch Information section for technical details on the fix.

Detection Methods for CVE-2026-31548

Indicators of Compromise

Unexpected kernel oops or panic messages referencing cfg80211_pmsr_process_abort, pmsr_free_wk, or driver-specific abort_pmsr callbacks.
Use-after-free reports from KASAN involving struct wireless_dev or PMSR request structures.
Wireless driver crashes correlated with rapid interface up/down cycles and concurrent nl80211 socket activity.

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for stack traces involving cfg80211 PMSR functions after wireless interface teardown.
Audit running kernel versions across the fleet against the patched commits listed in the vendor advisories to identify unpatched hosts.
Track local processes interacting with AF_NETLINK/NETLINK_GENERIC and issuing nl80211 PMSR commands, especially in conjunction with RTM_DELLINK or interface state changes.

Monitoring Recommendations

Enable kernel crash reporting (kdump, systemd-coredump) and forward kernel logs to a central log store for correlation.
Alert on repeated wireless interface flaps combined with elevated nl80211 activity from non-administrative users.
Include kernel package versions in endpoint inventory and continuously compare against the fixed versions published by your Linux distribution.

How to Mitigate CVE-2026-31548

Immediate Actions Required

Apply the patched Linux kernel package from your distribution vendor as soon as it is available and reboot affected systems.
Restrict local access to systems with active Wi-Fi interfaces, particularly multi-user hosts and shared workstations.
On systems that do not require wireless functionality, unload or blacklist cfg80211-dependent drivers to remove the attack surface.

Patch Information

The upstream fix cancels pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down() before calling cfg80211_pmsr_process_abort(). The fix is available in the following stable commits:

Workarounds

Disable Wi-Fi peer measurement features at the userspace level where supported by the wireless stack or NetworkManager configuration.
Limit which users can open nl80211 netlink sockets by tightening CAP_NET_ADMIN assignments and avoiding unnecessary privilege grants.
For systems that do not need wireless networking, remove or blacklist wireless drivers and the cfg80211 module to eliminate the vulnerable code path.