CVE-2026-31506 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel versions 6.6.1 through 6.12.80, 6.13 through 6.18.21, and 6.19 through 6.19.11 should assess their exposure to this vulnerability and apply patches as necessary.

Why it matters

CVE-2026-31506 is a double-free vulnerability in the Linux kernel's 'bcmasp' network block. Linux kernel maintainers and users should assess exposure and apply patches to mitigate the vulnerability.

• Verify Linux kernel versions and assess exposure to CVE-2026-31506
• Apply patches to mitigate potential double-free errors in the 'bcmasp' network block
• Monitor Linux kernel installations for signs of potential exploitation

Technical summary

The Linux kernel has a vulnerability in the 'bcmasp' network block, specifically related to the handling of WoL (Wake on LAN) IRQ, which could lead to a double-free error. This issue has been resolved through several patches. The vulnerability affects Linux kernel versions 6.6.1 through 6.12.80, 6.13 through 6.18.21, and 6.19 through 6.19.11. Users should assess their exposure to this vulnerability and apply patches as necessary. The patches address the improper handling of the WoL IRQ, preventing a potential double-free error.

Defensive priority

Linux kernel maintainers and users should assess exposure and apply patches to mitigate the vulnerability.

Recommended defensive actions

• Assess exposure of Linux kernel installations to CVE-2026-31506
• Apply patches provided by Linux kernel maintainers to address the vulnerability
• Monitor Linux kernel installations for signs of potential exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and associated NVD details provide information on the vulnerability, its impact, and patches to address it. Multiple source references are available, including several patch links. The official CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment. Several patch references are available, including references to specific patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.