CVE-2026-31548

A flaw was found in the Linux kernel's cfg80211 Wi-Fi subsystem. When a Wi-Fi interface is shut down, a scheduled work item (pmsr_free_wk) may not be properly cancelled. This can lead to the work item attempting to operate on an already removed interface, resulting in undefined behavior and potential system crashes, causing a Denial of Service (DoS).

This vulnerability is rated as having Moderate impact because exploitation is constrained to local access and requires the presence of active wireless networking hardware that supports peer measurements. In typical Red Hat Enterprise Linux server environments, Wi-Fi hardware is absent or unconfigured, greatly minimizing practical exposure. Furthermore, triggering the race condition requires specific timing between socket termination and interface teardown, restricting the impact to a denial of service without compromising system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.