Skip to main content

Linux Kernel EUVDEUVD-2026-25554

| CVE-2026-31661 MEDIUM
2026-04-24 Linux GHSA-2g4h-425m-78f8
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local kernel driver flaw requiring low-privilege user; no confidentiality or integrity impact; kernel panic yields high availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:42 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:17 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25554
CVE Published
Apr 24, 2026 - 14:45 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmsmac: Fix dma_free_coherent() size

dma_alloc_consistent() may change the size to align it. The new size is saved in alloced.

Change the free size to match the allocation size.

AnalysisAI

Memory mismanagement in the Linux kernel brcmsmac WiFi driver causes a kernel availability impact through a size mismatch between DMA allocation and deallocation. The brcmsmac driver incorrectly calls dma_free_coherent() with the original requested size rather than the aligned size stored in 'alloced' by dma_alloc_consistent(), which may have grown the allocation during alignment. This affects Linux from version 3.2 (commit 5b435de0) through multiple stable branches, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low exploitation probability.

Technical ContextAI

The brcmsmac driver (Broadcom BCM43xx 802.11n WiFi) uses the kernel DMA coherent memory API. dma_alloc_consistent() - the legacy wrapper around dma_alloc_coherent() - may silently grow the requested allocation size to meet hardware alignment constraints, storing the actual allocated size in the 'alloced' field. When dma_free_coherent() is later called with the original (smaller) size rather than the aligned 'alloced' size, the kernel's DMA mapping layer receives a mismatched size argument. Depending on kernel version and architecture, this mismatch can trigger a BUG_ON() check in the DMA subsystem or cause silent memory tracking corruption, ultimately leading to a kernel panic and denial of service. The CPE confirms this applies broadly to cpe:2.3:a:linux:linux across all architectures supporting brcmsmac. No CWE was formally assigned, but this maps to mismatched memory management operations (analogous to CWE-762: Mismatched Memory Management Routines).

RemediationAI

Upgrade to a patched Linux kernel stable release: 5.10.253 or later for the 5.10 LTS branch, 5.15.203 or later for 5.15 LTS, 6.1.169 or later for 6.1 LTS, 6.6.135 or later for 6.6 LTS, 6.12.82 or later for 6.12, 6.18.23 or later for 6.18, 6.19.13 or later for 6.19, or 7.0+ for mainline. Individual fix commits for each branch are available at the upstream stable kernel repository (https://git.kernel.org/stable/c/). Ubuntu users should apply USN-8567-1 via standard package management. Red Hat and SUSE users should monitor their respective security advisories for errata incorporating these fixes. As a workaround on systems where brcmsmac is not required, blacklisting the brcmsmac kernel module ('echo brcmsmac >> /etc/modprobe.d/blacklist.conf') eliminates the attack surface entirely with no functional impact on systems lacking Broadcom BCM43xx hardware; note this will disable WiFi on affected hardware.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25554 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy