{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"787152497ac763deab16f6f4b7ce79aaeb3eb7e8","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"8bb90ff77326c34e75b573b1febdd9586fec5aba","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"256f7d4c11235d0569f78413c41dc89d2dc1557c","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"29a1a350afcd28a2150bd73b8bd83eac3480f13e","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"5ba05436f15d16ae7ab04b880e8bf8d440be892b","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"b24763d32d5b4ada766deca4b42d6766272fef0c","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-31551","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix static_branch_dec() underflow for aql_disable.\n\nsyzbot reported static_branch_dec() underflow in aql_enable_write(). [0]\n\nThe problem is that aql_enable_write() does not serialise concurrent\nwrite()s to the debugfs.\n\naql_enable_write() checks static_key_false(&aql_disable.key) and\nlater calls static_branch_inc() or static_branch_dec(), but the\nstate may change between the two calls.\n\naql_disable does not need to track inc/dec.\n\nLet's use static_branch_enable() and static_branch_disable().\n\n[0]:\nval == 0\nWARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288\nModules linked in:\nCPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G     U       L      syzkaller #0 PREEMPT(full)\nTainted: [U]=USER, [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026\nRIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311\nCode: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00\nRSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4\nRDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000\nRBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a\nR13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98\nFS:  00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]\n __static_key_slow_dec kernel/jump_label.c:321 [inline]\n static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336\n aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343\n short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383\n vfs_write+0x2aa/0x1070 fs/read_write.c:684\n ksys_pwrite64 fs/read_write.c:793 [inline]\n __do_sys_pwrite64 fs/read_write.c:801 [inline]\n __se_sys_pwrite64 fs/read_write.c:798 [inline]\n __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f530cf9aeb9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012\nRAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9\nRDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010\nRBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000\nR10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978\n </TASK>","epss":{"date":"2026-11-05","percentile":0.02049,"score":0.00123},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915107558,"publishedAt":1777041198230,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/787152497ac763deab16f6f4b7ce79aaeb3eb7e8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/8bb90ff77326c34e75b573b1febdd9586fec5aba"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/256f7d4c11235d0569f78413c41dc89d2dc1557c"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/29a1a350afcd28a2150bd73b8bd83eac3480f13e"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5ba05436f15d16ae7ab04b880e8bf8d440be892b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b24763d32d5b4ada766deca4b42d6766272fef0c"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828"}],"remediation":[],"revision":"cc4f8113e28b5e2fa1d4449d73a8bc0aa57bd3b12e541e48b65cb67ceb04ba8d","sources":[{"modifiedAt":1793915107558,"name":"CNA: Linux","retrievedAt":1793917095223,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31551"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917101944,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31551"}],"ssvc":{"assessedAt":1793914714190,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.","updatedAt":1793917101944}