CVE-2026-31548

What it actually does

This is a local race condition in the Linux kernel cfg80211 Wi-Fi subsystem. A low-privileged local user that can interact with nl80211 can create a Position Measurement Service Request, close the originating netlink socket, and race that asynchronous cleanup against wireless interface teardown. Because a previously scheduled pmsr_free_wk work item may run after the wireless interface has already been removed, the kernel may invoke a driver abort_pmsr callback against stale or torn-down state. The most likely impact is kernel memory corruption, undefined driver behavior, or a kernel crash; depending on driver behavior and memory layout, broader privilege-impacting outcomes cannot be ruled out, which is reflected in the high CVSS impact ratings.

Why it matters to the business

Successful exploitation can destabilize Linux systems that use affected wireless networking code, causing crashes, reboots, service interruption, or potentially deeper host compromise if the race can be shaped into memory corruption. The issue requires local access and has very low current exploitation likelihood based on the provided EPSS score and no known KEV listing, so internet-facing mass exploitation is not the primary concern. Risk is highest for laptops, workstations, kiosks, embedded Linux devices, and appliances with Wi-Fi enabled and untrusted local users, containers, or sandboxed workloads that can access relevant netlink interfaces.

How an attack unfolds

An attacker first needs local code execution or an interactive low-privileged account on a Linux system with affected kernel Wi-Fi cfg80211 functionality available. The attacker opens an nl80211 socket and submits a PMSR-related request associated with a wireless interface. They then close the originating socket, causing cfg80211_release_pmsr() to clear the request port identifier and schedule asynchronous cleanup through pmsr_free_wk. In parallel, they trigger teardown of the associated wireless interface, such as by racing interface removal, wireless device reset, namespace cleanup, or other local operations that bring the interface down. The vulnerable path allows cfg80211_pmsr_wdev_down() to process the abort directly while the previously scheduled work item remains pending. If the queued work executes after the driver-facing interface state has been torn down, the driver's abort_pmsr callback may operate on invalid state, causing a kernel oops, panic, or undefined behavior. Reliable exploitation beyond denial of service would depend heavily on the specific wireless driver, kernel configuration, timing, and memory allocator behavior.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the cfg80211 fix to synchronously cancel and drain pmsr_free_wk in cfg80211_pmsr_wdev_down() before processing PMSR aborts during interface teardown. No exact fixed package versions were provided, so remediation should be tracked through vendor advisories and kernel changelogs for the patch described as "wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down". Where immediate patching is not possible, reduce exposure by disabling unused Wi-Fi hardware, removing or blocking wireless drivers on systems that do not require Wi-Fi, limiting local shell access to trusted users, restricting container/device access to netlink and wireless interfaces, and enforcing least privilege for users or services that can manipulate network interfaces. Reboot systems after kernel updates to ensure the fixed kernel is running.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, has been updated to a vendor build containing the cfg80211 pmsr_free_wk cancellation fix. Review distribution security advisories, kernel changelogs, or source patches for the specific fix text "cancel pmsr_free_wk in cfg80211_pmsr_wdev_down". Validate that systems have rebooted into the patched kernel using standard kernel inventory commands. For mitigations, confirm Wi-Fi devices and relevant wireless modules are disabled or unavailable on systems where Wi-Fi is not required. If performing controlled testing, reproduce only in a lab by exercising nl80211 PMSR request creation, socket closure, and wireless interface teardown while monitoring for kernel warnings, oopses, panics, or KASAN reports; absence of crashes is not by itself proof of remediation unless the patched code or vendor kernel version is confirmed.

Typical attack path

1. Gain local low-privileged access to a Linux system with an affected kernel and Wi-Fi/cfg80211 functionality enabled.
2. Open an nl80211 netlink socket and initiate a PMSR request against a wireless interface.
3. Close the nl80211 socket to cause cfg80211_release_pmsr() to schedule asynchronous PMSR cleanup via pmsr_free_wk.
4. Concurrently trigger wireless interface teardown or device removal before the scheduled work item has completed.
5. Race the pending pmsr_free_wk execution against cfg80211_pmsr_wdev_down() processing.
6. Cause the driver's abort_pmsr callback to run against torn-down interface state, potentially producing a kernel crash or other undefined behavior.

How to detect it

Look for signs of exploitation or attempted triggering in kernel and system logs rather than expecting a unique network indicator. Relevant sources include dmesg, journald, /var/log/kern.log, /var/log/messages, crash dumps, kdump/vmcore data, audit logs for local commands that manipulate wireless interfaces, and EDR telemetry for repeated netlink or wireless-management activity. Search for kernel oopses, panics, workqueue errors, use-after-free reports, KASAN/KMSAN findings, general protection faults, NULL pointer dereferences, or call traces involving cfg80211 PMSR paths, nl80211, pmsr_free_wk, cfg80211_pmsr_wdev_down, cfg80211_release_pmsr, cfg80211_pmsr_process_abort, or driver abort_pmsr callbacks. Correlate crashes with local users or processes repeatedly creating wireless measurement requests, closing netlink sockets, bringing Wi-Fi interfaces up/down, deleting interfaces, moving interfaces between namespaces, unloading wireless modules, or resetting Wi-Fi hardware. There are no known public exploit artifacts, named threat actors, KEV activity, or ransomware use provided for this issue, so detection should focus on anomalous local activity plus kernel fault evidence.

• cfg80211_pmsr_wdev_down
• cfg80211_release_pmsr
• cfg80211_pmsr_process_abort
• pmsr_free_wk
• abort_pmsr
• nl80211
• PMSR
• cfg80211
• kernel BUG
• kernel panic
• Oops:
• general protection fault
• NULL pointer dereference
• use-after-free
• KASAN:
• workqueue
• Call Trace:

What your security team should do

• Prioritize patching Linux laptops, workstations, kiosks, embedded devices, and appliances with Wi-Fi enabled and local multi-user exposure.
• Inventory Linux systems with wireless hardware, cfg80211/mac80211 modules, or vendor Wi-Fi drivers loaded, then map them to vendor kernel advisories.
• Update to a vendor-supported kernel containing the cfg80211 pmsr_free_wk fix and reboot to activate it.
• Temporarily disable Wi-Fi or unload/block unnecessary wireless modules on servers and appliances that do not require wireless networking.
• Restrict untrusted local users, containers, and sandboxed workloads from accessing network administration capabilities, wireless devices, and relevant netlink interfaces.
• Monitor kernel logs for cfg80211, PMSR, abort_pmsr, workqueue, use-after-free, NULL pointer dereference, general protection fault, oops, or panic events around wireless interface teardown.
• Treat unexplained kernel crashes on systems with Wi-Fi activity as potentially security-relevant until patched and reviewed.
• Because the vulnerability is not currently listed as known exploited and EPSS is low and flat, balance urgency against exposure: patch promptly in normal kernel maintenance cycles, but accelerate on devices with untrusted local access.