wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
Summary
| CVE | CVE-2026-93149 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-17 17:18:10 UTC |
|---|
| Updated | 2026-09-17 17:18:10 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
mac80211_hwsim_stop() drops any frames left in data->pending. The loop
currently checks skb_queue_empty() and then dequeues separately.
That split is racy with TX status handling, which can remove a pending
frame under the queue lock. If the last entry is removed after the empty
check, skb_dequeue() returns NULL and the stop path passes that NULL skb
to ieee80211_free_txskb().
Use skb_dequeue() as the loop condition instead. The dequeue result is the
object that stop owns and frees, and a concurrent status completion that
empties the queue simply makes the loop terminate. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected bd18de517923903a177508fc8813f44e717b1c00 d131027054a8dd922dda01fe8d381abe5af4970b git |
Not specified |
| CNA |
Linux |
Linux |
affected bd18de517923903a177508fc8813f44e717b1c00 c40ba47f2ba1951cb32ea048667ed014d36a5749 git |
Not specified |
| CNA |
Linux |
Linux |
affected bd18de517923903a177508fc8813f44e717b1c00 2817431a61557f46dc63077b7cc126bc906c242e git |
Not specified |
| CNA |
Linux |
Linux |
affected bd18de517923903a177508fc8813f44e717b1c00 e7fccad2c8e6ef6bbafe509c95869d161d0f466b git |
Not specified |
| CNA |
Linux |
Linux |
affected bd18de517923903a177508fc8813f44e717b1c00 1c2a4ab6efa26415dd131b8c222e7893fda03435 git |
Not specified |
| CNA |
Linux |
Linux |
affected bd18de517923903a177508fc8813f44e717b1c00 158438cd6ad69d6dd7d871582c38baf22169fede git |
Not specified |
| CNA |
Linux |
Linux |
affected 78bf3c6131488b00386acd9aff1ea4e6c44fa38e git |
Not specified |
| CNA |
Linux |
Linux |
affected a9028333001f793b2724e8be42fce3336de2cf1c git |
Not specified |
| CNA |
Linux |
Linux |
affected 7019c9f385b264a2d6f685028268422d55087e37 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.4.129 5.5 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.10.47 5.11 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.12.14 5.13 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.13 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.13 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.1.188 6.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.157 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.110 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.52 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.6 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc1 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.