The Linux kernel’s brcmsmac Wi-Fi driver has a memory accounting flaw that can crash vulnerable systems. The bug, tracked as CVE-2026-31661, requires local access and only impacts older Broadcom chips. If you’re using such hardware on Linux, patch now—but most users can rest easy.

The vulnerability was published in late April 2026 and stems from a mismatch between the size used for coherent DMA allocation and the size passed back during cleanup. In short, the driver wasn’t consistently remembering how much memory it really received, creating a path for a local attacker to trigger a denial-of-service by crashing the kernel. The CVSS 3.1 score sits at 5.5 Medium, with high availability impact but no confidentiality or integrity compromise—at least as far as the current public assessment goes.

What’s the actual bug?

At the center of CVE-2026-31661 is a Direct Memory Access (DMA) bookkeeping error in the brcmsmac driver, which handles certain older Broadcom IEEE 802.11n SoftMAC wireless cards. When the driver allocates coherent DMA memory using the kernel’s dma_alloc_consistent() function, the allocator may silently round up or align the size for hardware efficiency. The driver then needs to record that adjusted size and use the same value when freeing the memory with dma_free_coherent(). The vulnerable code stored the original size in an internal field, so the free operation sometimes handed back the wrong number—a mistake that can corrupt allocator metadata and crash the system.

This class of bug is easy to overlook in a patch diff but carries real operational importance. Kernel allocators are architecture-dependent and highly optimized, so a size mismatch that goes unnoticed on one platform may produce reliable crashes on another. The fix, which landed in multiple stable kernel branches, simply ensures the free path uses the stored adjusted size.

Who’s actually affected?

The brcmsmac driver supports a narrow slice of Broadcom Wi-Fi history—primarily PCIe and AXI SoftMAC chips like the BCM4313, BCM43224, and BCM43225. If you’re running a modern laptop with an Intel or Realtek wireless card, or if your Broadcom Wi-Fi uses the newer brcmfmac or proprietary wl drivers, you are not exposed to this specific flaw. The marketing name of your wireless adapter doesn’t matter; what matters is the kernel module actually loaded.

Three quick commands will tell you if you’re in the danger zone:

lsmod | grep brcmsmac          # Is the driver loaded right now?
lspci -k | grep -A2 Network   # Which driver handles your Wi-Fi hardware?
modinfo brcmsmac              # Is the module even installed?

If lsmod returns no output, the driver isn’t active and the immediate risk is low—though you should still keep kernels updated for other fixes. If you see brcmsmac listed, apply patches immediately.

Patching: What to do now

The remediation is a kernel update that includes the brcmsmac fix. Updating wireless firmware alone won’t help because the bug lives inside the kernel module itself. For most users, the process is straightforward:

  1. Apply system updates. Use your distribution’s package manager (apt, dnf, zypper, pacman, etc.) to upgrade the kernel and reboot.
  2. Verify the new kernel is running. Run uname -r and confirm the version matches the patched package.
  3. Test Wi-Fi functionality. After the reboot, ensure your wireless connection still works under normal conditions.
  4. If you don’t need brcmsmac at all, consider blacklisting the module to reduce attack surface: add blacklist brcmsmac to a file in /etc/modprobe.d/. But this is a hardening step, not a substitute for patching.

Specific fixed kernel versions include 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, and 6.19.13, along with later builds. However, many distributions backport the fix into older version numbers, so check your distro’s security tracker (Debian, Ubuntu, Red Hat, SUSE, etc.) rather than relying solely on upstream release tags. For example, a Red Hat Enterprise Linux 9 kernel might show version 5.14.0 but still carry the patch.

Why this isn’t a Windows problem

CVE-2026-31661 appears in Microsoft’s Security Response Center portal because Microsoft tracks Linux CVEs for its mixed-platform ecosystem—Azure, WSL, Linux-based appliances, and developer tools. This does not mean the Windows Wi-Fi stack has inherited the vulnerability. Windows desktops using the native networking stack are completely unaffected. If you dual-boot Linux on the same machine, you need to patch your Linux installation, not Windows.

WSL2 users should keep their WSL kernel updated (via wsl --update or through the Microsoft Store), but typical WSL instances don’t directly control the host’s Wi-Fi adapter through brcmsmac. Azure administrators with Linux VMs should follow their distribution’s guidance, though only physical hosts with the affected Broadcom hardware would be at real risk.

The broader lesson: old drivers still matter

The story of CVE-2026-31661 illustrates why seemingly dormant hardware drivers remain security concerns. Broadcom’s older Wi-Fi chips are still found in repurposed laptops, embedded devices, lab machines, and community-maintained hardware, and they depend on drivers that must be kept correct. The Linux kernel community now routinely assigns CVEs to memory-safety fixes, even small ones, to give administrators a more complete picture of potential defects. While this generates “CVE noise,” it also forces you to think about what code is actually running on your system.

For IT teams, the incident is a reminder to map loaded kernel modules against vulnerability advisories, not just installed packages. A Linux server with no wireless hardware faces near-zero risk from a Wi-Fi driver bug, but a shared student laptop or engineering workstation might be a different story. The lesson isn’t to panic over every driver CVE, but to maintain accurate asset inventories—including the actual hardware and active drivers—so you can triage intelligently.

What to watch next

The immediate task is to apply kernel updates on any affected Linux systems. After that, monitor your distribution’s security tracker for any revised scoring or newly discovered exploit methods. At present, CVE-2026-31661 is considered a local availability risk with no known remote exploitation vector, but researchers could eventually demonstrate a more impactful attack using the same DMA corruption primitive. Stay tuned to kernel mailing lists and vendor advisories for updates.

In the larger picture, this bug reinforces the need for cross-platform awareness. A CVE that starts in the Linux kernel can appear in a Microsoft advisory, light up your vulnerability scanner, and demand action on equipment you might have forgotten about. The right response is measured: check your hardware, apply the patch, and use the experience to improve how your household or organization handles low-severity, hardware-specific kernel issues.