Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - wifimac80211修复 aql_disable 的 static_branch_dec() 下溢。 syzbot 报告了 aql_enable_write() 中的 static_branch_dec() 下溢。 [0] 问题在于 aql_enable_write() 不会序列化 debugfs 中的并发 write()。 aql_enable_write() 检查 static_key_false(&aql_disable.key) 后会调用 static_branch_inc() 或 static_branch_dec()但这两个调用之间的状态可能会变更。 aql_disable 不需要跟踪 inc/dec。使用 static_branch_enable() 和 static_branch_disable() 即可。 [0]val == 0 警告kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311 CPU#0: CPU: 0 中链接的UID0 PID20288 Comm
    syz.1.3155 受感染GUL syzkaller #0 PREEMPT(full) 受感染[U]=USER、[L]=SOFTLOCKUP 硬件名称
    Google Google Compute Engine/Google Compute Engine、BIOS Google 2026 年 1 月 24 日 RIP
    0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311 代码 f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00 RSP: 0018:ffffc9000b9f7c10 EFLAGS
    00010293 RAX0000000000000000 RBXffffffff9b3e5d40 RCXffffffff823c57b4 RDXffff8880285a0000 RSI
    ffffffff823c5846 RDI: ffff8880285a0000 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a R13: 1ffff9200173ef88 R14:
     R150000000000000001  : ffffc9000b9f7e98 FS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001140 CR3:
    000000007cc4a000 CR4: 00000000003526f0 Call Trace: <TASK> __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline] __static_key_slow_dec kernel/jump_label.c:321 [inline] static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336 aql_enable_write+0x2b2/0x310 net/ mac80211/debugfs.c:343 short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383 vfs_write+0x2aa/0x1070 fs/read_write.c:684 ksys_pwrite64 fs/read_write.c:793 [inline] __do_sys_pwrite64 fs/read_write.c :801 [inline] __se_sys_pwrite64 fs/read_write.c:798 [inline] __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/ x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP0033:0x7f530cf9aeb9 代码ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 89 dca 4 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP
    002b00007f530dd72028 EFLAGS00000246 ORIG_RAX0000000000000012 RAXffffffffffffffda RBX
    00007f530d215fa0 RCX: 00007f530cf9aeb9 RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010 RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 4200000000000005 R11:
    0000000000000246 R120000000000000000 R1300007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978 </TASK> (CVE-2026-31551)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2026-31551

medium Nessus 插件 ID 310159

版本 1.16