CVE-2026-31551: wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Fix staticbranchdec() underflow for aqldisable.
syzbot reported staticbranchdec() underflow in aqlenablewrite(). [0]
The problem is that aqlenablewrite() does not serialise concurrent write()s to the debugfs.
aqlenablewrite() checks statickeyfalse(&aqldisable.key) and later calls staticbranchinc() or staticbranchdec(), but the state may change between the two calls.
aqldisable does not need to track inc/dec.
Let's use staticbranchenable() and staticbranchdisable().
[0]: val == 0 WARNING: kernel/jumplabel.c:311 at statickeyslowdeccpuslocked.part.0+0x107/0x120 kernel/jumplabel.c:311, CPU#0: syz.1.3155/20288 Modules linked in: CPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:statickeyslowdeccpuslocked.part.0+0x107/0x120 kernel/jumplabel.c:311 Code: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00 RSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4 RDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a R13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98 FS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0 Call Trace: <TASK> statickeyslowdeccpuslocked kernel/jumplabel.c:297 [inline] statickeyslowdec kernel/jumplabel.c:321 [inline] statickeyslowdec+0x7c/0xc0 kernel/jumplabel.c:336 aqlenablewrite+0x2b2/0x310 net/mac80211/debugfs.c:343 shortproxywrite+0x133/0x1a0 fs/debugfs/file.c:383 vfswrite+0x2aa/0x1070 fs/readwrite.c:684 ksyspwrite64 fs/readwrite.c:793 [inline] dosyspwrite64 fs/readwrite.c:801 [inline] sesyspwrite64 fs/readwrite.c:798 [inline] x64syspwrite64+0x1eb/0x250 fs/readwrite.c:798 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xc9/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f530cf9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIGRAX: 0000000000000012 RAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9 RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010 RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978 </TASK>
Affected Software
Remediation
Event History
Frequently Asked Questions
What access and conditions are needed to trigger the issue?
The CVSS vector indicates local access and low privileges are required. The reported failure depends on concurrent writes to the relevant mac80211 debugfs control, allowing its state to change between the check and the static-branch update.
How can administrators identify a possible occurrence?
The reported symptom is a static_branch_dec() underflow warning from kernel/jump_label.c, specifically in __static_key_slow_dec_cpuslocked.part.0. The warning was observed while handling a value of 0 in the affected control path.
What should be done if affected?
A patch is available through the listed stable kernel references. No alternative non-patch mitigation is provided in the available data.