High 7.8Published Apr 24, 2026

CVE-2026-31548wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down

Updated under an hour ago (Oct 27, 2026, 10:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down When the nl80211 socket that originated a PMSR request is closed, cfg80211_release_pmsr() sets the request's nl_portid to zero and schedules pmsr_free_wk to process the abort asynchronously. If the interface is concurrently torn down before that work runs, cfg80211_pmsr_wdev_down() calls cfg80211_pmsr_process_abort() directly. However, the already- scheduled pmsr_free_wk work item remains pending and may run after the interface has been removed from the driver. This could cause the driver's abort_pmsr callback to operate on a torn-down interface, leading to undefined behavior and potential crashes. Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down() before calling cfg80211_pmsr_process_abort(). This ensures any pending or in-progress work is drained before interface teardown proceeds, preventing the work from invoking the driver abort callback after the interface is gone.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 before 28d3551f8d8cb3aec7497894d94150fe84d20e5e; from 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 before 37e776e2e0a523731e2470dce6d563f0e8632a40; from 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 before d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa; from 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 before a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf; from 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 before 72b7ea786b8e570ae11149e9089859a4a8634a13; 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 builds before 6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09	CNA record
linux linux_kernel linux:linux_kernel	from 5.0.1 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 5.0; 7.0; 7.0; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/28d3551f8d8cb3aec7497894d94150fe84d20e5e	patch
https://git.kernel.org/stable/c/37e776e2e0a523731e2470dce6d563f0e8632a40	patch
https://git.kernel.org/stable/c/d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa	patch
https://git.kernel.org/stable/c/a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf	patch
https://git.kernel.org/stable/c/72b7ea786b8e570ae11149e9089859a4a8634a13	patch
https://git.kernel.org/stable/c/6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.