Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - wifimac80211修正 aql_disable 的 static_branch_dec() 反向溢位。 syzbot 報告 aql_enable_write() 中有 static_branch_dec() 反向溢位。 [0] 問題在於 aql_enable_write() 未將並行 write() 序列化為 debugf。 aql_enable_write() 會檢查 static_key_false(&aql_disable.key) 及稍後呼叫 static_branch_inc() 或 static_branch_dec()但狀態可能會在兩個呼叫之間變更。 aql_disable 不需要追踪 inc/dec。讓我們使用 static_branch_enable() 和 static_branch_disable()。 [0]: val == 0 警告kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311 CPU#0syz.1.3155/20288 模組連結CPU: 0 UID0 PID20288 Comm
    syz.1.3155 污染GUL syzkaller #0 PREEMPT(full) 污染[U]=USER、[L]=SOFTLOCKUP 硬體名稱
    Google Google Compute Engine/Google Compute Engine、BIOS Google 2026 年 1 月 24 日 RIP
    0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311 程式碼f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00 RSP0018:ffffc9000b9f7c10 EFLAGS
    00010293 RAX0000000000000000 RBXffffffff9b3e5d40 RCXffffffff823c57b4 RDXffff8880285a0000 RSI
    ffffffff823c5846 RDI: ffff8880285a0000 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a R13: 1ffff9200173ef88 R14:
     R150000000000000001  : ffffc9000b9f7e98 FS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000001140 CR3:
    000000007cc4a000 CR4: 00000000003526f0 Call Trace: <TASK> __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline] __static_key_slow_dec kernel/jump_label.c:321 [inline] static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336 aql_enable_write+0x2b2/0x310 net/ mac80211/debugfs.c:343 short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383 vfs_write+0x2aa/0x1070 fs/read_write.c:684 ksys_pwrite64 fs/read_write.c:793 [內嵌] __do_sys_pwrite64 fs/read_write.c :801 [內嵌] __se_sys_pwrite64 fs/read_write.c:798 [內嵌] __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [內嵌] do_syscall_64+0xc9/0xf80 arch/ x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP 0033:0x7f530cf9aeb9 程式碼ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 6d 4 f 7 8 8 8 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP
    002b:00007f530dd72028 EFLAGS00000246 ORIG_RAX: 0000000000000012 RAXffffffffffffffda RBX
    00007f530d215fa0 RCX: 00007f530cf9aeb9 RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010 RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 4200000000000005 R11:
    0000000000000246 R120000000000000000 R1300007f530d216038 R1400007f530d215fa0 R1500007ffde89fb978 </TASK> (CVE-2026-31551)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

偵測

Linux Distros 未修補的弱點：CVE-2026-31551

high Nessus Plugin ID 310159

版本 1.1