In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down

When the nl80211 socket that originated a PMSR request is
closed, cfg80211_release_pmsr() sets the request's nl_portid
to zero and schedules pmsr_free_wk to process the abort
asynchronously. If the interface is concurrently torn down
before that work runs, cfg80211_pmsr_wdev_down() calls
cfg80211_pmsr_process_abort() directly. However, the already-
scheduled pmsr_free_wk work item remains pending and may run
after the interface has been removed from the driver. This
could cause the driver's abort_pmsr callback to operate on a
torn-down interface, leading to undefined behavior and
potential crashes.

Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()
before calling cfg80211_pmsr_process_abort(). This ensures any
pending or in-progress work is drained before interface teardown
proceeds, preventing the work from invoking the driver abort
callback after the interface is gone.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
9bb7e0f24e7e7d00daa1219b14539e2e602649b2 affected < 28d3551f8d8cb3aec7497894d94150fe84d20e5e
9bb7e0f24e7e7d00daa1219b14539e2e602649b2 affected < 37e776e2e0a523731e2470dce6d563f0e8632a40
9bb7e0f24e7e7d00daa1219b14539e2e602649b2 affected < d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa
9bb7e0f24e7e7d00daa1219b14539e2e602649b2 affected < a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf
9bb7e0f24e7e7d00daa1219b14539e2e602649b2 affected < 72b7ea786b8e570ae11149e9089859a4a8634a13
9bb7e0f24e7e7d00daa1219b14539e2e602649b2 affected < 6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09
Linux Linux affected
Version Status Constraints
5.0 affected —
0 unaffected < 5.0
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.78 unaffected ≤ 6.12.*
6.18.20 unaffected ≤ 6.18.*
6.19.10 unaffected ≤ 6.19.*
7.0 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/28d3551f8d8cb3aec7497894d94150fe84d20e5e cve-icon cve-icon
https://git.kernel.org/stable/c/37e776e2e0a523731e2470dce6d563f0e8632a40 cve-icon cve-icon
https://git.kernel.org/stable/c/6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09 cve-icon cve-icon
https://git.kernel.org/stable/c/72b7ea786b8e570ae11149e9089859a4a8634a13 cve-icon cve-icon
https://git.kernel.org/stable/c/a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf cve-icon cve-icon
https://git.kernel.org/stable/c/d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026042425-CVE-2026-31548-3d88@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-31548 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-31548 cve-icon
History

Sat, 25 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-366
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 24 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down When the nl80211 socket that originated a PMSR request is closed, cfg80211_release_pmsr() sets the request's nl_portid to zero and schedules pmsr_free_wk to process the abort asynchronously. If the interface is concurrently torn down before that work runs, cfg80211_pmsr_wdev_down() calls cfg80211_pmsr_process_abort() directly. However, the already- scheduled pmsr_free_wk work item remains pending and may run after the interface has been removed from the driver. This could cause the driver's abort_pmsr callback to operate on a torn-down interface, leading to undefined behavior and potential crashes. Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down() before calling cfg80211_pmsr_process_abort(). This ensures any pending or in-progress work is drained before interface teardown proceeds, preventing the work from invoking the driver abort callback after the interface is gone.
Title wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-04-24T14:33:16.021Z

Reserved: 2026-03-09T15:48:24.114Z

Link: CVE-2026-31548

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-24T15:16:28.930

Modified: 2026-04-24T17:51:40.810

Link: CVE-2026-31548

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31548 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses