CVE-2026-31551: wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.

Published Apr 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Fix staticbranchdec() underflow for aqldisable.

syzbot reported staticbranchdec() underflow in aqlenablewrite(). [0]

The problem is that aqlenablewrite() does not serialise concurrent write()s to the debugfs.

aqlenablewrite() checks statickeyfalse(&aqldisable.key) and later calls staticbranchinc() or staticbranchdec(), but the state may change between the two calls.

aqldisable does not need to track inc/dec.

Let's use staticbranchenable() and staticbranchdisable().

[0]: val == 0 WARNING: kernel/jumplabel.c:311 at statickeyslowdeccpuslocked.part.0+0x107/0x120 kernel/jumplabel.c:311, CPU#0: syz.1.3155/20288 Modules linked in: CPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:statickeyslowdeccpuslocked.part.0+0x107/0x120 kernel/jumplabel.c:311 Code: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00 RSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4 RDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a R13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98 FS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0 Call Trace: <TASK> statickeyslowdeccpuslocked kernel/jumplabel.c:297 [inline] statickeyslowdec kernel/jumplabel.c:321 [inline] statickeyslowdec+0x7c/0xc0 kernel/jumplabel.c:336 aqlenablewrite+0x2b2/0x310 net/mac80211/debugfs.c:343 shortproxywrite+0x133/0x1a0 fs/debugfs/file.c:383 vfswrite+0x2aa/0x1070 fs/readwrite.c:684 ksyspwrite64 fs/readwrite.c:793 [inline] dosyspwrite64 fs/readwrite.c:801 [inline] sesyspwrite64 fs/readwrite.c:798 [inline] x64syspwrite64+0x1eb/0x250 fs/readwrite.c:798 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xc9/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f530cf9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIGRAX: 0000000000000012 RAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9 RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010 RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978 </TASK>

Affected Software

209 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=5.12.1<5.15.203
Linux Linux kernel>=5.16<6.1.167
Linux Linux kernel>=6.2<6.6.130
Linux Linux kernel>=6.7<6.12.78
Linux Linux kernel>=6.13<6.18.20
Linux Linux kernel>=6.19<6.19.10
Linux Linux kernel=5.12
Linux Linux kernel=7.0-rc1
Linux Linux kernel=7.0-rc2
Linux Linux kernel=7.0-rc3
Linux Linux kernel=7.0-rc4
Linux Linux kernel=7.0-rc5
Linux Linux kernel=7.0-rc6
Linux Linux kernel=7.0-rc7
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15<5.15.0-1112.119~20.04.1
5.15.0-1112.119~20.04.1
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15<5.15.0-1117.126~20.04.1
5.15.0-1117.126~20.04.1
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.15<5.15.0-1117.126~20.04.2
5.15.0-1117.126~20.04.2
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15<5.15.0-1112.122~20.04.1
5.15.0-1112.122~20.04.1
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15<5.15.0-186.196~20.04.1
5.15.0-186.196~20.04.1
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm-5.15<5.15.0-1106.110~20.04.1
5.15.0-1106.110~20.04.1
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15<5.15.0-1107.113~20.04.1
5.15.0-1107.113~20.04.1
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-184.194~20.04.1
5.15.0-184.194~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1064.66~20.04.1
5.15.0-1064.66~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15<5.15.0-1109.115~20.04.1
5.15.0-1109.115~20.04.1
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15<5.15.0-1106.110~20.04.1
5.15.0-1106.110~20.04.1
ubuntu/linux-riscv-5.8*
ubuntu/linux<5.15.0-186.196
5.15.0-186.196
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1112.119
5.15.0-1112.119
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1061.64~22.04.1
6.8.0-1061.64~22.04.1
ubuntu/linux-azure<5.15.0-1117.126
5.15.0-1117.126
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1063.71~22.04.1
6.8.0-1063.71~22.04.1
ubuntu/linux-azure-fde<5.15.0-1117.126
5.15.0-1117.126
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8<6.8.0-1062.69~22.04.1
6.8.0-1062.69~22.04.1
ubuntu/linux-gcp<5.15.0-1112.122
5.15.0-1112.122
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1064.72~22.04.1
6.8.0-1064.72~22.04.1
ubuntu/linux-gke<5.15.0-1108.114
5.15.0-1108.114
ubuntu/linux-gkeop<5.15.0-1095.103
5.15.0-1095.103
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-136.136~22.04.1
6.8.0-136.136~22.04.1
ubuntu/linux-ibm<5.15.0-1106.110
5.15.0-1106.110
ubuntu/linux-ibm-6.8<6.8.0-1061.62~22.04.1
6.8.0-1061.62~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1107.113
5.15.0-1107.113
ubuntu/linux-kvm<5.15.0-1104.109
5.15.0-1104.109
ubuntu/linux-lowlatency<5.15.0-184.194
5.15.0-184.194
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-136.136.2~22.04.1
6.8.0-136.136.2~22.04.1
ubuntu/linux-nvidia<5.15.0-1107.108
5.15.0-1107.108
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1059.62~22.04.1
6.8.0-1059.62~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1064.66
5.15.0-1064.66
ubuntu/linux-nvidia-tegra-igx<5.15.0-1053.53
5.15.0-1053.53
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1109.115
5.15.0-1109.115
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1058.61~22.04.1
6.8.0-1058.61~22.04.1
ubuntu/linux-raspi<5.15.0-1106.109
5.15.0-1106.109
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-136.136~22.04.3
6.8.0-136.136~22.04.3
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1075.79
5.15.0-1075.79
ubuntu/linux-bluefield<5.15.0-1096.98
5.15.0-1096.98
ubuntu/linux-intel-iot-realtime<5.15.0-1104.106
5.15.0-1104.106
ubuntu/linux-realtime<5.15.0-1111.120
5.15.0-1111.120
ubuntu/linux-realtime-6.8<6.8.1-1056.57~22.04.2
6.8.1-1056.57~22.04.2
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1112.119+fips1
5.15.0-1112.119+fips1
ubuntu/linux-azure-fips<5.15.0-1117.126+fips1
5.15.0-1117.126+fips1
ubuntu/linux-fips<5.15.0-186.196+fips1
5.15.0-186.196+fips1
ubuntu/linux-gcp-fips<5.15.0-1112.122+fips1
5.15.0-1112.122+fips1
ubuntu/linux<6.8.0-136.136
6.8.0-136.136
ubuntu/linux-aws<6.8.0-1061.64
6.8.0-1061.64
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17*
ubuntu/linux-azure<6.8.0-1063.71
6.8.0-1063.71
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17*
ubuntu/linux-azure-fde<6.8.0-1062.69
6.8.0-1062.69
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1064.72
6.8.0-1064.72
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gke<6.8.0-1059.67
6.8.0-1059.67
ubuntu/linux-gkeop<6.8.0-1046.50
6.8.0-1046.50
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17*
ubuntu/linux-ibm<6.8.0-1061.62
6.8.0-1061.62
ubuntu/linux-lowlatency<6.8.0-136.136.2
6.8.0-136.136.2
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia<6.8.0-1059.62
6.8.0-1059.62
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17*
ubuntu/linux-nvidia-lowlatency<6.8.0-1059.62.1
6.8.0-1059.62.1
ubuntu/linux-nvidia-tegra<6.8.0-1030.31
6.8.0-1030.31
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17*
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1058.61
6.8.0-1058.61
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17*
ubuntu/linux-raspi<6.8.0-1061.65
6.8.0-1061.65
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17*
ubuntu/linux-xilinx<6.8.0-1033.34
6.8.0-1033.34
ubuntu/linux-bluefield<6.8.0-1028.33
6.8.0-1028.33
ubuntu/linux-raspi-realtime<6.8.0-2050.52
6.8.0-2050.52
ubuntu/linux-realtime<6.8.1-1056.57
6.8.1-1056.57
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17*
ubuntu/linux-aws-fips<6.8.0-1061.64+fips1
6.8.0-1061.64+fips1
ubuntu/linux-azure-fips<6.8.0-1063.71+fips2
6.8.0-1063.71+fips2
ubuntu/linux-fips<6.8.0-136.136+fips2
6.8.0-136.136+fips2
ubuntu/linux-gcp-fips<6.8.0-1064.72+fips1
6.8.0-1064.72+fips1
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-azure*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp*
ubuntu/linux-oracle*
ubuntu/linux-raspi*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
linux/kernel>=5.12.0<5.15.203
5.15.203
linux/kernel>=5.16.0<6.1.167
6.1.167
linux/kernel>=6.2.0<6.6.130
6.6.130
linux/kernel>=6.7.0<6.12.78
6.12.78
linux/kernel>=6.13.0<6.18.20
6.18.20
linux/kernel>=6.19.0<6.19.10
6.19.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
  2. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119~20.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126~20.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126~20.04.2
  5. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122~20.04.1
  6. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196~20.04.1
  7. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110~20.04.1
  8. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.113~20.04.1
  9. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-184.194~20.04.1
  10. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1064.66~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.115~20.04.1
  12. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110~20.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119
  15. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64~22.04.1
  16. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126
  17. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71~22.04.1
  18. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126
  19. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69~22.04.1
  20. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122
  21. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72~22.04.1
  22. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1108.114
  23. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1095.103
  24. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136~22.04.1
  25. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.110
  26. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.62~22.04.1
  27. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.113
  28. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.109
  29. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-184.194
  30. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136.2~22.04.1
  31. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1107.108
  32. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62~22.04.1
  33. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1064.66
  34. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1053.53
  35. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.115
  36. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61~22.04.1
  37. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1106.109
  38. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136~22.04.3
  39. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1075.79
  40. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1096.98
  41. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1104.106
  42. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1111.120
  43. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1056.57~22.04.2
  44. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.119+fips1
  45. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.126+fips1
  46. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-186.196+fips1
  47. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.122+fips1
  48. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136
  49. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64
  50. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71
  51. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1062.69
  52. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72
  53. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.67
  54. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1046.50
  55. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.62
  56. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136.2
  57. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62
  58. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1059.62.1
  59. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1030.31
  60. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.61
  61. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.65
  62. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.34
  63. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.33
  64. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2050.52
  65. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1056.57
  66. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1061.64+fips1
  67. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1063.71+fips2
  68. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-136.136+fips2
  69. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.72+fips1
  70. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 5.15.203
  71. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.1.167
  72. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.6.130
  73. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.12.78
  74. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.18.20
  75. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.19.10
  76. Configuration

    Change aql_enable_write() to serialize concurrent debugfs writes and use static_branch_enable() or static_branch_disable() directly; aql_disable does not need static_branch_inc()/static_branch_dec() tracking.

    Linux kernel mac80211 aql_enable_write() aql_disable = static_branch_enable()/static_branch_disable()

Event History

Apr 24, 2026
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
Description
Data Sourced
via OSV·02:33 PM
DescriptionAffected Software
Data Sourced
via OSV·03:16 PM
Severity
Data Sourced
via NVD·03:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Apr 29, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What access and conditions are needed to trigger the issue?

The CVSS vector indicates local access and low privileges are required. The reported failure depends on concurrent writes to the relevant mac80211 debugfs control, allowing its state to change between the check and the static-branch update.

2

How can administrators identify a possible occurrence?

The reported symptom is a static_branch_dec() underflow warning from kernel/jump_label.c, specifically in __static_key_slow_dec_cpuslocked.part.0. The warning was observed while handling a value of 0 in the affected control path.

3

What should be done if affected?

A patch is available through the listed stable kernel references. No alternative non-patch mitigation is provided in the available data.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203