CVE-2026-31551: Linux Kernel Race Condition Vulnerability

CVE-2026-31551 Overview

A vulnerability has been identified in the Linux kernel's WiFi mac80211 subsystem related to improper handling of the static_branch_dec() function for aql_disable. The flaw was discovered through syzkaller fuzzing, which reported a static_branch_dec() underflow condition in the aql_enable_write() function.

The core issue stems from the lack of serialization for concurrent write operations to the debugfs interface. When aql_enable_write() checks static_key_false(&aql_disable.key) and subsequently calls static_branch_inc() or static_branch_dec(), a race condition can occur where the state changes between these two operations, leading to an integer underflow condition.

Critical Impact

Local attackers with access to the debugfs interface can trigger a kernel warning and potentially cause a denial of service condition through the integer underflow in the AQL (Airtime Queue Limits) disable mechanism.

Affected Products

• Linux Kernel versions prior to the security patch
• Linux Kernel 5.12 and related versions
• Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

• April 24, 2026 - CVE-2026-31551 published to NVD
• April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31551

Vulnerability Analysis

This vulnerability is classified as CWE-191 (Integer Underflow). The flaw exists in the aql_enable_write() function located in net/mac80211/debugfs.c. The function handles write operations to the AQL (Airtime Queue Limits) enable/disable debugfs interface but fails to properly serialize concurrent access.

The debugfs interface allows users to toggle the AQL feature, but the implementation uses static_branch_inc() and static_branch_dec() to track the enable/disable state. These functions modify static keys used for runtime patching of kernel code. When multiple write operations occur simultaneously without proper locking, the reference count can become inconsistent, resulting in an underflow when static_branch_dec() is called on an already-zero counter.

The kernel warning triggered indicates that the value reached zero unexpectedly, which can lead to undefined behavior in the jump label subsystem and potentially cause system instability or denial of service.

Root Cause

The root cause is the absence of proper synchronization mechanisms in aql_enable_write(). The function performs a check-then-act operation without holding any locks, creating a classic Time-of-Check to Time-of-Use (TOCTOU) race condition. The aql_disable static key does not inherently require increment/decrement tracking, making the original implementation unnecessarily complex and vulnerable.

The fix replaces static_branch_inc() and static_branch_dec() with static_branch_enable() and static_branch_disable(), which are atomic operations that set the key state directly rather than tracking a reference count.

Attack Vector

The vulnerability requires local access to the system with sufficient privileges to write to the debugfs filesystem. An attacker would need to:

1. Mount the debugfs filesystem (typically at /sys/kernel/debug/)
2. Access the mac80211 AQL enable debugfs file
3. Trigger concurrent writes to race the check-then-act sequence
4. Cause the static_branch_dec() underflow by manipulating the timing

The exploitation mechanism involves triggering the race condition in the debugfs write handler. When concurrent write operations modify the AQL state simultaneously, the lack of synchronization allows the reference counter to underflow when decremented past zero. This triggers a kernel warning in __static_key_slow_dec_cpuslocked() at kernel/jump_label.c:311.

Detection Methods for CVE-2026-31551

Indicators of Compromise

• Kernel warning messages containing __static_key_slow_dec_cpuslocked and val == 0 in system logs
• Stack traces referencing aql_enable_write in net/mac80211/debugfs.c
• Unexpected system instability related to WiFi subsystem operations
• Debugfs access patterns showing rapid concurrent writes to mac80211 AQL files

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for WARNING messages from kernel/jump_label.c:311
• Implement auditd rules to track write access to /sys/kernel/debug/ieee80211/*/aql_enable files
• Use SentinelOne's kernel integrity monitoring to detect anomalous debugfs operations
• Deploy file integrity monitoring on critical debugfs interfaces

Monitoring Recommendations

• Enable kernel tracing for mac80211 subsystem operations using ftrace or eBPF
• Configure SentinelOne agents to alert on kernel warning signatures related to jump label underflows
• Set up automated alerts for repeated kernel warnings from the same source location
• Monitor system stability metrics for WiFi-related components

How to Mitigate CVE-2026-31551

Immediate Actions Required

• Apply the latest kernel security patches from the Linux kernel stable tree
• Restrict access to debugfs by limiting mount permissions or using appropriate SELinux/AppArmor policies
• Monitor systems for exploitation attempts while patches are being deployed
• Consider disabling debugfs on production systems where it is not required

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix replaces the increment/decrement-based state tracking with direct enable/disable operations, eliminating the race condition. Multiple patch commits are available across different kernel stable branches:

• Kernel Git Commit 256f7d4
• Kernel Git Commit 29a1a35
• Kernel Git Commit 5ba0543
• Kernel Git Commit 7871524
• Kernel Git Commit 8bb90ff
• Kernel Git Commit b24763d
• Kernel Git Commit b94ae8e

Workarounds

• Unmount debugfs on systems where it is not actively required: umount /sys/kernel/debug
• Restrict debugfs mount permissions using filesystem access controls
• Apply SELinux or AppArmor policies to limit debugfs access to essential administrative processes only
• Limit user access to systems until patches can be applied

# Restrict debugfs access (temporary workaround)
# Unmount debugfs if not required
umount /sys/kernel/debug 2>/dev/null || true

# Alternatively, remount with restrictive permissions
mount -o remount,mode=0700 /sys/kernel/debug

# Verify debugfs is not mounted or has restricted access
mount | grep debugfs