The Linux kernel vulnerability CVE-2026-31506 involves a double free error in the bcmasp network driver related to the Wake-on-LAN (WoL) interrupt (wol_irq). The driver incorrectly freed wol_irq, which was originally allocated using devm_request_irq(), a device-managed resource that is automatically freed by the device resource management system. This double free could lead to memory corruption, potentially causing system crashes or allowing an attacker with local privileges to compromise system integrity and availability. The issue affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related builds. The vulnerability has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a high severity with local attack vector, low attack complexity, and requiring low privileges. Ubuntu has released patches addressing this and other kernel vulnerabilities, and users should apply updates and reboot to mitigate the risk.

Successful exploitation of this double free vulnerability could lead to memory corruption in the kernel, resulting in potential system crashes or privilege escalation. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access with low privileges and no user interaction. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should update their Linux kernel to version 6.8.0-1064.72 or later (and corresponding patched versions) as provided by their distribution vendor. After updating, a system reboot is required to apply the fix. Due to an ABI change in the kernel update, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's official advisory and update instructions carefully.