wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.50 % · centile 43 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Analyzed
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails. However, in wlcore_tx_work_locked(), a return value of -EAGAIN from wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being full. This causes the code to flush the buffer, put the skb back at the head of the queue, and immediately retry the same skb in a tight while loop. Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens immediately with GFP_ATOMIC, this will result in an infinite loop and a CPU soft lockup. Return -ENOMEM instead so the packet is dropped and the loop terminates. The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y.
Faiblesses (CWE)
- CWE-835 — Boucle dont la condition de sortie est inatteignable (boucle infinie)
Références
- https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99
- https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea
- https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f
- https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8
- https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610
- https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c
- https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c
- https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-25445
- GCVE · GCVE-0-2026-31552
Avis du CERT-FR
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0696 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0547 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.250 < 5.10.253cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.200 < 5.15.203cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.163 < 6.1.167cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.124 < 6.6.130cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12.70 < 6.12.78cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.18.10 < 6.18.20cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19.1 < 6.19.10cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 88295a55fefe5414e64293638b6f7549646e58ed < 980f793645540ca7a6318165cc12f49d5febeb99 ; affected cd89a4656c03f8db0c57350aaec69cd3cfaa3522 < 12f9eef39e49716c763714bfda835a733d5f6dea ; affected 745a0810dbc96a0471e5f5e627ba1e978c3116d4 < ceb46b40b021d21911ff8608ce4ed33c1264ad2f ; affected b167312390fdd461c81ead516f2b0b44e83a9edb < a6dc74209462c4fe5a88718d2f3a5286886081c8 ; affected 71de0b6e04bbee5575caf9a1e4d424e7dcc50018 < cfa64e2b3717be1da7c4c1aff7268a009e8c1610 ; affected 689a7980e4788e13e766763d53569fb78dea2513 < 46c670ff1ff466e5eccb3940f726586473dc053c |
| Linux · Linux | affected 6.19 ; unaffected 0 < 6.19 ; unaffected 5.10.253 ≤ 5.10.* ; unaffected 5.15.203 ≤ 5.15.* ; unaffected 6.1.167 ≤ 6.1.* ; unaffected 6.6.130 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |