CVE-2026-31551

What it actually does

This is a local race condition in the Linux kernel mac80211 debugfs handler for the AQL enable/disable control. Concurrent writes to the mac80211 debugfs entry can cause the kernel static branch reference counter for aql_disable to underflow, triggering a kernel warning/BUG path in jump_label handling. The practical impact is availability loss: a local user with permission to write to the relevant debugfs file can destabilize the kernel and potentially crash or hang the system. The CVSS vector indicates local access, low attack complexity, low privileges, no user interaction, no confidentiality impact, no integrity impact, and high availability impact.

Why it matters to the business

Successful exploitation can cause affected Linux systems using the mac80211 wireless stack with debugfs exposed to become unstable or unavailable. For workstations, embedded Linux devices, wireless appliances, lab systems, or infrastructure that relies on Wi-Fi functionality, this can result in service interruption, device reboot requirements, operational downtime, or degraded wireless service. The current EPSS is very low and flat over 30 days, it is not listed in CISA KEV, and no public exploit maturity is reported, so broad internet-scale exploitation is unlikely; however, the issue still matters where local users, containers, test harnesses, or less-trusted workloads can access debugfs.

How an attack unfolds

An attacker first needs local code execution on an affected Linux system and sufficient permissions to write to the mac80211 AQL debugfs control. The attacker then performs concurrent writes that toggle the AQL setting through debugfs. Because the vulnerable code checks the static branch state and later increments or decrements it without serializing concurrent writers, two or more writes can observe stale state and perform an invalid decrement. This causes a static_branch_dec/static_key underflow in the kernel jump label subsystem. The resulting kernel warning or fault can destabilize the host, leading to denial of service. This is not a remote code execution issue and does not directly expose data or allow privilege escalation based on the provided information.

How to fix it

Apply a Linux kernel update from the relevant distribution or vendor that includes the mac80211 fix replacing reference-counted static_branch_inc()/static_branch_dec() behavior with static_branch_enable()/static_branch_disable() for this control path. No exact fixed package versions were provided in the input, so use vendor advisories, distribution security trackers, or upstream stable kernel changelogs to identify the first fixed kernel for each supported branch. As interim mitigation, avoid exposing debugfs on production systems unless required, unmount debugfs where possible, restrict access to /sys/kernel/debug to trusted administrators only, prevent containers from mounting or accessing host debugfs, and limit local shell access on systems using affected kernels. Reboot into the updated kernel after installation; installing a kernel package alone is not sufficient until the fixed kernel is running.

How to confirm the fix worked

Confirm the system is running a kernel build that includes the mac80211 aql_disable static branch fix, not merely that an updated package is installed. Validate with uname -a, distribution package metadata, and vendor advisory references. Check whether debugfs is mounted at /sys/kernel/debug and whether mac80211 debugfs entries are present; if debugfs is not mounted or is inaccessible to non-administrative users, exposure is reduced. On patched systems, concurrent writes to the relevant AQL debugfs control should not produce static_branch_dec underflow warnings, jump_label warnings, kernel oops messages, soft lockups, or unexpected reboots. For fleet validation, inventory Linux kernel versions and prioritize systems with wireless/mac80211 support and debugfs enabled.

Typical attack path

1. Gain local access to an affected Linux system, either as a local user, compromised process, container with excessive host filesystem access, or test workload.
2. Identify that debugfs is mounted and that mac80211 debugfs entries are available for the wireless interface stack.
3. Obtain write access to the relevant mac80211 AQL debugfs control, commonly requiring elevated privileges or overly permissive debugfs exposure.
4. Launch multiple concurrent writes that rapidly toggle the AQL enable/disable value.
5. Trigger a race in aql_enable_write() where the static branch state changes between the state check and the increment/decrement operation.
6. Cause a static_branch_dec/static_key underflow in the kernel jump label code.
7. Crash, hang, or otherwise destabilize the system, resulting in local denial of service.

How to detect it

To determine whether exploitation has already occurred, review kernel logs and system journals for warnings, oopses, panics, soft lockups, or reboots that reference mac80211 debugfs, aql_enable_write(), static_branch_dec(), static_key underflow, or jump_label.c. Useful sources include journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, dmesg output, pstore/ramoops records after reboot, crash dumps, and endpoint telemetry that records process activity against /sys/kernel/debug. Correlate kernel events with auditd, eBPF, EDR, or shell history showing writes to mac80211 debugfs entries. Look for bursts of concurrent write operations to AQL-related debugfs files shortly before a kernel warning, soft lockup, panic, or unexplained reboot. There are no known named threat actors or ransomware campaigns associated with this issue from the provided data, so detection should focus on local abuse patterns and kernel crash artifacts rather than remote network indicators.

• static_branch_dec() underflow
• __static_key_slow_dec_cpuslocked
• __static_key_slow_dec
• static_key_slow_dec
• kernel/jump_label.c:311
• kernel/jump_label.c:321
• kernel/jump_label.c:336
• aql_enable_write
• net/mac80211/debugfs.c:343
• short_proxy_write
• fs/debugfs/file.c:383
• val == 0
• WARNING: kernel/jump_label.c:311
• mac80211
• aql_disable
• /sys/kernel/debug
• /sys/kernel/debug/ieee80211
• soft lockup
• kernel oops
• Kernel panic
• BUG: kernel NULL pointer dereference
• Tainted: G U L

What your security team should do

• Patch or upgrade affected Linux kernels through the operating system vendor and reboot into the fixed kernel.
• Prioritize systems where debugfs is mounted, Wi-Fi/mac80211 is enabled, or local users and untrusted workloads have interactive or containerized access.
• Restrict /sys/kernel/debug to root-only administrative use and unmount debugfs on production systems where it is not operationally required.
• Review container runtime and sandbox policies to ensure containers cannot mount or write to host debugfs.
• Monitor kernel logs for static_branch_dec, static_key, jump_label, aql_enable_write, mac80211 debugfs, soft lockup, kernel oops, or unexpected reboot events.
• Treat repeated local kernel warning/oops events involving aql_enable_write as potential denial-of-service attempts, especially if correlated with local user activity or suspicious concurrent writes.
• Because EPSS is low, KEV is false, and no mature exploit is reported, schedule remediation according to normal kernel maintenance unless affected systems expose debugfs to less-trusted local users, in which case accelerate patching.