CVE-2026-31661

What it actually does

CVE-2026-31661 is a local denial-of-service vulnerability in the Linux kernel brcmsmac Wi-Fi driver. The driver allocated DMA-coherent memory using a size that could be adjusted for alignment, but later freed it using the original size rather than the actual allocated size. This allocation/free size mismatch can corrupt DMA memory-management state or trigger kernel memory-management errors, potentially causing a kernel warning, crash, or system instability. The CVSS vector indicates local access with low attack complexity and low privileges required, no user interaction, and high availability impact, with no expected confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can crash or destabilize affected Linux systems that include and use the vulnerable brcmsmac wireless driver, causing service interruption, device downtime, and operational disruption. Risk is highest for Linux endpoints, embedded systems, appliances, or edge devices using Broadcom wireless hardware supported by brcmsmac. The vulnerability is not listed in CISA KEV, has no known mature public exploit, has a very low and flat EPSS score, and is not associated with ransomware campaigns, so broad internet-scale exploitation is unlikely; however, systems where local users or untrusted workloads can access the affected driver should still be patched during normal kernel maintenance cycles.

How an attack unfolds

An attacker first needs local access to an affected Linux system with low privileges. They then exercise code paths in the brcmsmac wireless driver that allocate DMA-coherent memory and later free it. Because the driver frees the buffer with a size that may differ from the adjusted allocation size, the kernel DMA subsystem may detect inconsistent metadata or mishandle the free operation. Repeated or carefully timed triggering can lead to kernel instability or a crash, resulting in denial of service. Exploitation does not provide remote code execution, privilege escalation, or data theft based on the available vulnerability details.

How to fix it

Update the Linux kernel to a vendor release that includes the upstream brcmsmac fix changing the dma_free_coherent() free size to match the actual allocation size saved in the driver. Because fixed versions were not provided in the input, use the kernel package versions published by the relevant Linux distribution, device vendor, or appliance vendor for CVE-2026-31661. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the brcmsmac module on systems that do not require it, preventing untrusted local users from interacting with wireless management functions, restricting shell access, and avoiding unnecessary driver reload/reset operations. Reboot systems after kernel updates so the fixed kernel and driver are active.

How to confirm the fix worked

Confirm the system is running a kernel build that contains the brcmsmac fix, not merely that an updated package is installed. Validate with distribution package metadata, vendor advisories, changelogs, or source review showing the driver frees DMA-coherent memory using the adjusted allocated size. Check whether the brcmsmac module is present or loaded using tools such as lsmod, modinfo, and kernel package inventory. After patching, reboot and verify the active kernel version with uname -r. For mitigations, confirm the brcmsmac module is not loaded and is blocked from autoloading if wireless functionality is not required.

Typical attack path

1. Obtain local, low-privileged access to an affected Linux host or device.
2. Confirm the system loads or can load the brcmsmac Wi-Fi driver for supported Broadcom wireless hardware.
3. Trigger brcmsmac driver operations that allocate and free DMA-coherent memory, such as wireless interface initialization, reset, suspend/resume, or driver unload/reload paths.
4. Cause the vulnerable free path to run with a mismatched DMA allocation size.
5. Induce kernel memory-management errors, a kernel oops, panic, or system hang, resulting in denial of service.

How to detect it

To determine whether exploitation may have already occurred, review host-level telemetry because this is a local kernel-driver denial-of-service issue and is unlikely to produce network indicators. Focus on kernel logs, system journals, crash dumps, uptime/reboot records, and endpoint telemetry around unexpected reboots, kernel oops events, panics, hangs, or driver resets involving brcmsmac, DMA allocation/free operations, or Broadcom wireless interfaces. Relevant sources include /var/log/kern.log, /var/log/messages, /var/log/syslog, journalctl -k output, pstore/ramoops records, kdump/vmcore artifacts, systemd journal reboot history, audit logs for module load/unload activity, and EDR process telemetry for commands that manipulate kernel modules or wireless interfaces. Look for repeated local activity such as modprobe/rmmod of brcmsmac, interface resets, suspend/resume abuse, or crashes shortly after brcmsmac initialization. There are no known threat actors or public exploit campaigns associated with this vulnerability in the provided data.

• brcmsmac
• dma_free_coherent
• dma_alloc_consistent
• kernel oops
• Kernel panic
• BUG: kernel NULL pointer dereference
• WARNING: CPU:
• Oops:
• bcm43xx
• Broadcom
• modprobe brcmsmac
• rmmod brcmsmac
• /sys/module/brcmsmac
• /lib/modules/*/kernel/drivers/net/wireless/broadcom/brcm80211/brcmsmac/brcmsmac.ko
• journalctl -k

What your security team should do

• Inventory Linux systems, embedded devices, and appliances that use Broadcom Wi-Fi hardware or have the brcmsmac kernel module available.
• Prioritize patching systems where local users, contractors, kiosks, containers with device access, or untrusted workloads can interact with the affected host.
• Apply vendor kernel updates that include the brcmsmac DMA free-size fix and reboot to activate the fixed kernel.
• If brcmsmac is not needed, blacklist or remove the module as a compensating control.
• Monitor kernel logs for brcmsmac, DMA, kernel oops, panic, or memory-corruption messages that may indicate attempted triggering or operational instability.
• Treat this as a moderate-priority availability issue given low EPSS, no KEV listing, no known ransomware use, and no reported exploit maturity, unless critical operations depend on affected wireless Linux devices.