CVE-2026-31551: Linux Kernel Race Condition Vulnerability

CVE-2026-31551 Overview

CVE-2026-31551 is a medium-severity integer underflow vulnerability [CWE-191] in the Linux kernel's mac80211 wireless subsystem. The flaw resides in the aql_enable_write() function within net/mac80211/debugfs.c. Concurrent writes to the Airtime Queue Limits (AQL) debugfs interface are not serialized, allowing a race between the static_key_false() check and subsequent static_branch_inc() or static_branch_dec() calls. The race triggers a static_branch_dec() underflow, producing a kernel warning and destabilizing the affected static key state. The issue was reported by syzbot fuzzing infrastructure and affects multiple Linux kernel branches from 5.12 through 7.0-rc7.

Critical Impact
Local users with write access to debugfs can trigger a static key state underflow in mac80211, leading to kernel warnings and potential denial-of-service conditions on wireless-enabled hosts.

Affected Products

Linux Kernel 5.12 (initial introduction of the affected code path)
Linux Kernel 7.0-rc1 through 7.0-rc7
Multiple stable branches receiving the backported mac80211 debugfs serialization fix

Discovery Timeline

2026-04-24 - CVE-2026-31551 published to the National Vulnerability Database
2026-04-27 - Last modified in the NVD database

Technical Details for CVE-2026-31551

Vulnerability Analysis

The vulnerability is an integer underflow in the kernel's static key reference counting, triggered through the mac80211 debugfs interface. The aql_enable_write() handler in net/mac80211/debugfs.c exposes a writable control over the aql_disable static branch. The handler reads the current state with static_key_false(&aql_disable.key), then calls either static_branch_inc() or static_branch_dec() based on the prior state and the new user-supplied value.

Because aql_enable_write() performs no locking, two concurrent writers can observe the same initial state and both decide to decrement the static key. The second decrement drives the reference counter below zero, hitting the warning in __static_key_slow_dec_cpuslocked.part.0 at kernel/jump_label.c:311. The corrupted static key state can leave AQL configuration in an inconsistent mode and may interfere with subsequent toggles.

The fix replaces the inc/dec pattern with idempotent static_branch_enable() and static_branch_disable() calls, since aql_disable does not require reference counting semantics.

Root Cause

The root cause is missing concurrency control on a debugfs write handler that uses a check-then-act pattern against a shared static key. The function assumes serialized writes but provides no mutex, spinlock, or atomic compare-and-swap to enforce that assumption. Combined with the underflow-sensitive static_branch_dec() primitive, any race produces the kernel warning observed by syzbot.

Attack Vector

Exploitation requires local access with privileges sufficient to write to /sys/kernel/debug/ieee80211/<phy>/aql_enable. On most distributions, this means root or a user explicitly granted access to debugfs. An attacker spawns two or more threads that concurrently issue pwrite64() calls toggling the AQL enable state. The resulting underflow generates a WARN and corrupts the static branch state controlling AQL on the wireless stack. The CVSS vector indicates a local attack with low complexity affecting availability only, with no confidentiality or integrity impact.

No verified public exploit code is available. The vulnerability mechanism is described above based on the upstream commit message and the syzbot crash trace referenced in the advisory.

Detection Methods for CVE-2026-31551

Indicators of Compromise

Kernel log entries containing WARNING: kernel/jump_label.c:311 and the symbol __static_key_slow_dec_cpuslocked.part.0.
Stack traces referencing aql_enable_write+0x and short_proxy_write originating from net/mac80211/debugfs.c:343.
Repeated pwrite64 syscalls targeting aql_enable files under /sys/kernel/debug/ieee80211/.

Detection Strategies

Monitor dmesg and journalctl -k for the specific jump_label.c:311 warning signature paired with aql_enable_write in the call trace.
Audit debugfs access using auditd rules on /sys/kernel/debug/ieee80211 to flag non-administrative writers.
Correlate kernel warnings with process accounting data to identify the user and command that triggered the underflow.

Monitoring Recommendations

Forward kernel ring buffer output to a centralized log platform and alert on static_key_slow_dec warnings.
Track mount events for debugfs and tracefs to detect unexpected exposure on production hosts.
Baseline legitimate mac80211 debugfs usage so that anomalous concurrent writers stand out in telemetry.

How to Mitigate CVE-2026-31551

Immediate Actions Required

Apply the upstream mac80211 patch that converts aql_enable_write() to use static_branch_enable() and static_branch_disable().
Restrict debugfs mounts to root-only access using the mode=0700 mount option or unmount debugfs on production systems that do not require it.
Audit which local accounts have effective write access to /sys/kernel/debug and remove unnecessary privileges.

Patch Information

The fix is distributed as a set of stable-tree commits on git.kernel.org. Apply the kernel update appropriate for your branch from the following references: Kernel commit 256f7d4c1123, Kernel commit 29a1a350afcd, Kernel commit 5ba05436f15d, Kernel commit 787152497ac7, Kernel commit 8bb90ff77326, Kernel commit b24763d32d5b, and Kernel commit b94ae8e0d5fe. Rebuild and reboot affected kernels after patch application.

Workarounds

Unmount debugfs on systems where it is not required: umount /sys/kernel/debug.
Remount debugfs with restrictive permissions so only root can traverse it.
Disable wireless modules on servers that do not use Wi-Fi, eliminating the mac80211 attack surface entirely.

bash

# Restrict debugfs to root-only access
mount -o remount,mode=700 /sys/kernel/debug

# Or unmount debugfs entirely on systems that do not need it
umount /sys/kernel/debug

# Verify the running kernel includes the mac80211 aql_enable fix
uname -r