CVE-2026-31548

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: cancel pmsrfreewk in cfg80211pmsrwdev_down

When the nl80211 socket that originated a PMSR request is closed, cfg80211releasepmsr() sets the request's nlportid to zero and schedules pmsrfreewk to process the abort asynchronously. If the interface is concurrently torn down before that work runs, cfg80211pmsrwdevdown() calls cfg80211pmsrprocessabort() directly. However, the already- scheduled pmsrfreewk work item remains pending and may run after the interface has been removed from the driver. This could cause the driver's abortpmsr callback to operate on a torn-down interface, leading to undefined behavior and potential crashes.

Cancel pmsrfreewk synchronously in cfg80211pmsrwdevdown() before calling cfg80211pmsrprocessabort(). This ensures any pending or in-progress work is drained before interface teardown proceeds, preventing the work from invoking the driver abort callback after the interface is gone.