High 7.5Published Apr 24, 2026

CVE-2026-31552wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom

Updated under an hour ago (Oct 28, 2026, 7:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails. However, in wlcore_tx_work_locked(), a return value of -EAGAIN from wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being full. This causes the code to flush the buffer, put the skb back at the head of the queue, and immediately retry the same skb in a tight while loop. Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens immediately with GFP_ATOMIC, this will result in an infinite loop and a CPU soft lockup. Return -ENOMEM instead so the packet is dropped and the loop terminates. The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	88295a55fefe5414e64293638b6f7549646e58ed builds before 980f793645540ca7a6318165cc12f49d5febeb99; from cd89a4656c03f8db0c57350aaec69cd3cfaa3522 before 12f9eef39e49716c763714bfda835a733d5f6dea; from 745a0810dbc96a0471e5f5e627ba1e978c3116d4 before ceb46b40b021d21911ff8608ce4ed33c1264ad2f; from b167312390fdd461c81ead516f2b0b44e83a9edb before a6dc74209462c4fe5a88718d2f3a5286886081c8; from 71de0b6e04bbee5575caf9a1e4d424e7dcc50018 before cfa64e2b3717be1da7c4c1aff7268a009e8c1610; 689a7980e4788e13e766763d53569fb78dea2513 builds before 46c670ff1ff466e5eccb3940f726586473dc053c; from e75665dd096819b1184087ba5718bd93beafff51 before f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c; from e75665dd096819b1184087ba5718bd93beafff51 before deb353d9bb009638b7762cae2d0b6e8fdbb41a69; and 6 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.10.250 before 5.10.253; from 5.15.200 before 5.15.203; from 6.1.163 before 6.1.167; from 6.6.124 before 6.6.130; from 6.12.70 before 6.12.78; from 6.18.10 before 6.18.20; from 6.19.1 before 6.19.10; 6.19; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99	patch
https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea	patch
https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f	patch
https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8	patch
https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610	patch
https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c	patch
https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c	patch
https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.