Medium 5.5Published Feb 14, 2026

CVE-2025-71222wifi: wlcore: ensure skb headroom before skb_push

Updated under an hour ago (Oct 26, 2026, 10:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: ensure skb headroom before skb_push This avoids occasional skb_under_panic Oops from wl1271_tx_work. In this case, headroom is less than needed (typically 110 - 94 = 16 bytes).

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f5fc0f86b02afef1119b523623b4cde41475bc8c before 88295a55fefe5414e64293638b6f7549646e58ed; from f5fc0f86b02afef1119b523623b4cde41475bc8c before cd89a4656c03f8db0c57350aaec69cd3cfaa3522; from f5fc0f86b02afef1119b523623b4cde41475bc8c before 745a0810dbc96a0471e5f5e627ba1e978c3116d4; from f5fc0f86b02afef1119b523623b4cde41475bc8c before b167312390fdd461c81ead516f2b0b44e83a9edb; from f5fc0f86b02afef1119b523623b4cde41475bc8c before 71de0b6e04bbee5575caf9a1e4d424e7dcc50018; from f5fc0f86b02afef1119b523623b4cde41475bc8c before 689a7980e4788e13e766763d53569fb78dea2513; from f5fc0f86b02afef1119b523623b4cde41475bc8c before e75665dd096819b1184087ba5718bd93beafff51	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.32 before 5.10.250; from 5.11 before 5.15.200; from 5.16 before 6.1.163; from 6.2 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/88295a55fefe5414e64293638b6f7549646e58ed	patch
https://git.kernel.org/stable/c/cd89a4656c03f8db0c57350aaec69cd3cfaa3522	patch
https://git.kernel.org/stable/c/745a0810dbc96a0471e5f5e627ba1e978c3116d4	patch
https://git.kernel.org/stable/c/b167312390fdd461c81ead516f2b0b44e83a9edb	patch
https://git.kernel.org/stable/c/71de0b6e04bbee5575caf9a1e4d424e7dcc50018	patch
https://git.kernel.org/stable/c/689a7980e4788e13e766763d53569fb78dea2513	patch
https://git.kernel.org/stable/c/e75665dd096819b1184087ba5718bd93beafff51	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.