CVE-2026-31661: Linux Kernel DMA Memory Leak Vulnerability

CVE-2026-31661 Overview

A memory management vulnerability has been identified in the Linux kernel's brcmsmac WiFi driver. The issue stems from a size mismatch between DMA memory allocation and deallocation operations. When dma_alloc_consistent() is called, it may adjust the requested size for alignment purposes and store the actual allocated size in the alloced variable. However, the corresponding dma_free_coherent() call was using the original requested size rather than the adjusted allocation size, leading to improper memory handling.

Critical Impact
This vulnerability can cause system instability and denial of service conditions on systems using Broadcom wireless adapters with the brcmsmac driver, as improper DMA memory handling can lead to kernel crashes or memory corruption.

Affected Products

Linux Kernel version 3.2 and later
Linux Kernel version 7.0 release candidates (rc1 through rc7)
Systems using Broadcom wireless chipsets with the brcmsmac driver

Discovery Timeline

2026-04-24 - CVE-2026-31661 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31661

Vulnerability Analysis

This vulnerability exists in the brcmsmac wireless driver's DMA memory management code. The DMA (Direct Memory Access) subsystem in Linux requires precise size tracking for memory allocations because the hardware DMA controller operates with specific alignment requirements. When allocating DMA-coherent memory using dma_alloc_consistent(), the kernel may round up the requested size to meet alignment constraints, storing the actual allocated size in a tracking variable called alloced.

The flaw occurs because the deallocation path was not using this tracked size. Instead, it passed the original requested size to dma_free_coherent(), creating a mismatch between what was allocated and what is being freed. This discrepancy can result in incomplete memory frees, memory leaks, or corruption of DMA memory pool metadata.

Root Cause

The root cause is an inconsistency in how the brcmsmac driver tracks DMA memory sizes. The dma_alloc_consistent() function aligns memory to hardware requirements and saves the true allocation size in the alloced field. However, dma_free_coherent() was incorrectly called with the pre-alignment size value instead of reading from alloced. This violates the DMA API contract which requires that the size passed to the free function must exactly match the size used during allocation.

Attack Vector

This vulnerability requires local access to the system. An attacker with local privileges could potentially trigger repeated WiFi driver operations that cause DMA allocation and deallocation cycles, leading to memory corruption or resource exhaustion. The attack surface is limited to systems with Broadcom wireless hardware using the brcmsmac driver. While the vulnerability primarily results in availability impact (denial of service through system instability), the memory corruption aspects could potentially be leveraged in more sophisticated attack chains.

The fix involves changing the free operation to use the alloced variable that contains the correct aligned size, ensuring the freed size matches the allocated size. Patches have been backported across multiple kernel stable branches.

Detection Methods for CVE-2026-31661

Indicators of Compromise

Kernel log messages indicating DMA memory errors or warnings from the brcmsmac driver
System crashes or kernel panics occurring during WiFi operations
Memory allocation failures in kernel space related to DMA operations
Unusual memory consumption patterns in the kernel DMA pool

Detection Strategies

Monitor kernel logs (dmesg) for warnings or errors from the brcmsmac or DMA subsystems
Use kernel memory debugging tools like KASAN (Kernel Address Sanitizer) to detect memory inconsistencies
Implement system monitoring for unexpected kernel crashes on systems with Broadcom wireless hardware
Review loaded kernel modules with lsmod | grep brcmsmac to identify vulnerable systems

Monitoring Recommendations

Enable kernel DMA debugging options in development or test environments to catch size mismatches
Configure automated alerts for kernel panic events on affected systems
Monitor system stability metrics for systems using Broadcom wireless adapters
Implement regular kernel version audits to identify unpatched systems

How to Mitigate CVE-2026-31661

Immediate Actions Required

Update to a patched Linux kernel version that includes the fix
If immediate patching is not possible, consider temporarily disabling the brcmsmac driver and using alternative network connectivity
Monitor affected systems for stability issues until patches can be applied
Review kernel version and backport availability for your distribution

Patch Information

The Linux kernel development team has released patches across multiple stable branches to address this vulnerability. The fix modifies the dma_free_coherent() call to use the alloced variable that stores the actual allocation size, ensuring consistency between allocation and deallocation operations.

Patches are available via the following kernel git commits:

Workarounds

Blacklist the brcmsmac driver by adding blacklist brcmsmac to /etc/modprobe.d/blacklist.conf if the wireless functionality is not required
Use alternative wireless drivers if available for your hardware (e.g., brcmfmac for newer Broadcom chips)
Disable WiFi hardware via BIOS/UEFI settings as a temporary measure on critical systems
Implement network segmentation to limit exposure of affected systems

bash

# Blacklist brcmsmac driver as a temporary workaround
echo "blacklist brcmsmac" | sudo tee /etc/modprobe.d/brcmsmac-blacklist.conf
sudo update-initramfs -u
sudo reboot