{"api_version":"1","generated_at":"2026-11-05T23:41:19+00:00","cve":"CVE-2026-99134","urls":{"html":"https://cve.report/CVE-2026-99134","api":"https://cve.report/api/cve/CVE-2026-99134.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99134","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99134"},"summary":{"title":"mac802154: fix data race and NULL deref on local->assoc_dev","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix data race and NULL deref on local->assoc_dev\n\nlocal->assoc_dev is shared between the association path and the\nassociation-response worker without common synchronization.\n\nmac802154_perform_association() stores the coordinator pointer and waits\nfor a response. Its timeout and error paths clear the pointer and return\nto mac802154_associate(), which may then free the coordinator object.\nMeanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit\nand enter mac802154_process_association_resp(), which dereferences\nassoc_dev.\n\nThe worker's bit test and the handler's pointer dereference are not\natomic with respect to cleanup. Cleanup can clear assoc_dev between them,\ncausing a NULL dereference, or free the coordinator while the response\nhandler still uses the pointer.\n\nThe recorded result is exposed to the same window. assoc_status and\nassoc_addr are written by the handler but read by the association path\nwhile the associating bit is still set, so a second response for the same\nrequest - a malicious one, for instance - can replace them between those\nreads and leave the caller with an incoherent status and address pair.\n\nThe response handler only needs the coordinator extended address.\nReplace assoc_dev with a cached address, removing the pointer lifetime\ndependency. Protect the cached address and the associating bit with a\ndedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee\nan atomic __le64 access on all 32-bit architectures.\n\nwpan_dev->association_lock cannot be reused here: nl802154_associate()\nholds it across rdev_associate(), hence for the whole of\nmac802154_perform_association() including the wait for the response.\nA response handler taking that lock would only get it once the\nassociation has already given up.\n\nReset the completion, publish the cached address, and set the associating\nbit while holding the lock. The response handler takes the lock, rechecks\nthe bit and the cached address, records the response, clears the bit, and\nonly then completes the waiter. Thus cleanup cannot pass the handler\nbetween its state check and completion, and the cached 64-bit value\ncannot tear.\n\nThe handler clears the bit before completing, not the woken waiter:\notherwise complete() is issued under the lock and a second (e.g.\nmalicious) response can reacquire it before the waiter and replace the\nresult. So a wait that returns success implies the bit is already clear,\nand the success and negative-response paths return directly. The\ntransmit-error and timeout paths still clear it under assoc_lock, which\nserializes any racing response against the cleanup while the call returns\nthe error it already selected. Both paths snapshot assoc_status and\nassoc_addr under the same lock.\n\nBoth users run in process context, so a plain spinlock is sufficient.\nThe lock is not held while waiting for the completion.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-28 11:17:33","updated_at":"2026-10-30 13:21:47"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/3cdd8b1abddebbae2582e90294c77b61d5f5aee7","name":"https://git.kernel.org/stable/c/3cdd8b1abddebbae2582e90294c77b61d5f5aee7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a585901bb8cd2cd60d678be8a56ca6a4e1a6946c","name":"https://git.kernel.org/stable/c/a585901bb8cd2cd60d678be8a56ca6a4e1a6946c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c037915f80c4db47f7d061d68e703ffd551b1a34","name":"https://git.kernel.org/stable/c/c037915f80c4db47f7d061d68e703ffd551b1a34","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cfbb59fb0bc8ec82d98189a4df66ccc03d159386","name":"https://git.kernel.org/stable/c/cfbb59fb0bc8ec82d98189a4df66ccc03d159386","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99134","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99134","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fefd19807fe9c65002366c749e809996a1ca4e68 cfbb59fb0bc8ec82d98189a4df66ccc03d159386 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fefd19807fe9c65002366c749e809996a1ca4e68 3cdd8b1abddebbae2582e90294c77b61d5f5aee7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fefd19807fe9c65002366c749e809996a1ca4e68 a585901bb8cd2cd60d678be8a56ca6a4e1a6946c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fefd19807fe9c65002366c749e809996a1ca4e68 c037915f80c4db47f7d061d68e703ffd551b1a34 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.115 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.59 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.13 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"99134","cve":"CVE-2026-99134","epss":"0.001680000","percentile":"0.061730000","score_date":"2026-11-01","updated_at":"2026-11-02 00:05:55"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mac802154/ieee802154_i.h","net/mac802154/main.c","net/mac802154/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cfbb59fb0bc8ec82d98189a4df66ccc03d159386","status":"affected","version":"fefd19807fe9c65002366c749e809996a1ca4e68","versionType":"git"},{"lessThan":"3cdd8b1abddebbae2582e90294c77b61d5f5aee7","status":"affected","version":"fefd19807fe9c65002366c749e809996a1ca4e68","versionType":"git"},{"lessThan":"a585901bb8cd2cd60d678be8a56ca6a4e1a6946c","status":"affected","version":"fefd19807fe9c65002366c749e809996a1ca4e68","versionType":"git"},{"lessThan":"c037915f80c4db47f7d061d68e703ffd551b1a34","status":"affected","version":"fefd19807fe9c65002366c749e809996a1ca4e68","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mac802154/ieee802154_i.h","net/mac802154/main.c","net/mac802154/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.59","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.59","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.13","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix data race and NULL deref on local->assoc_dev\n\nlocal->assoc_dev is shared between the association path and the\nassociation-response worker without common synchronization.\n\nmac802154_perform_association() stores the coordinator pointer and waits\nfor a response. Its timeout and error paths clear the pointer and return\nto mac802154_associate(), which may then free the coordinator object.\nMeanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit\nand enter mac802154_process_association_resp(), which dereferences\nassoc_dev.\n\nThe worker's bit test and the handler's pointer dereference are not\natomic with respect to cleanup. Cleanup can clear assoc_dev between them,\ncausing a NULL dereference, or free the coordinator while the response\nhandler still uses the pointer.\n\nThe recorded result is exposed to the same window. assoc_status and\nassoc_addr are written by the handler but read by the association path\nwhile the associating bit is still set, so a second response for the same\nrequest - a malicious one, for instance - can replace them between those\nreads and leave the caller with an incoherent status and address pair.\n\nThe response handler only needs the coordinator extended address.\nReplace assoc_dev with a cached address, removing the pointer lifetime\ndependency. Protect the cached address and the associating bit with a\ndedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee\nan atomic __le64 access on all 32-bit architectures.\n\nwpan_dev->association_lock cannot be reused here: nl802154_associate()\nholds it across rdev_associate(), hence for the whole of\nmac802154_perform_association() including the wait for the response.\nA response handler taking that lock would only get it once the\nassociation has already given up.\n\nReset the completion, publish the cached address, and set the associating\nbit while holding the lock. The response handler takes the lock, rechecks\nthe bit and the cached address, records the response, clears the bit, and\nonly then completes the waiter. Thus cleanup cannot pass the handler\nbetween its state check and completion, and the cached 64-bit value\ncannot tear.\n\nThe handler clears the bit before completing, not the woken waiter:\notherwise complete() is issued under the lock and a second (e.g.\nmalicious) response can reacquire it before the waiter and replace the\nresult. So a wait that returns success implies the bit is already clear,\nand the success and negative-response paths return directly. The\ntransmit-error and timeout paths still clear it under assoc_lock, which\nserializes any racing response against the cleanup while the call returns\nthe error it already selected. Both paths snapshot assoc_status and\nassoc_addr under the same lock.\n\nBoth users run in process context, so a plain spinlock is sufficient.\nThe lock is not held while waiting for the completion."}],"providerMetadata":{"dateUpdated":"2026-10-30T12:42:07.557Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/cfbb59fb0bc8ec82d98189a4df66ccc03d159386"},{"url":"https://git.kernel.org/stable/c/3cdd8b1abddebbae2582e90294c77b61d5f5aee7"},{"url":"https://git.kernel.org/stable/c/a585901bb8cd2cd60d678be8a56ca6a4e1a6946c"},{"url":"https://git.kernel.org/stable/c/c037915f80c4db47f7d061d68e703ffd551b1a34"}],"title":"mac802154: fix data race and NULL deref on local->assoc_dev","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99134","datePublished":"2026-10-28T10:34:47.193Z","dateReserved":"2026-09-25T10:25:14.394Z","dateUpdated":"2026-10-30T12:42:07.557Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-28 11:17:33","lastModifiedDate":"2026-10-30 13:21:47","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99134","Ordinal":"1","Title":"mac802154: fix data race and NULL deref on local->assoc_dev","CVE":"CVE-2026-99134","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99134","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix data race and NULL deref on local->assoc_dev\n\nlocal->assoc_dev is shared between the association path and the\nassociation-response worker without common synchronization.\n\nmac802154_perform_association() stores the coordinator pointer and waits\nfor a response. Its timeout and error paths clear the pointer and return\nto mac802154_associate(), which may then free the coordinator object.\nMeanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit\nand enter mac802154_process_association_resp(), which dereferences\nassoc_dev.\n\nThe worker's bit test and the handler's pointer dereference are not\natomic with respect to cleanup. Cleanup can clear assoc_dev between them,\ncausing a NULL dereference, or free the coordinator while the response\nhandler still uses the pointer.\n\nThe recorded result is exposed to the same window. assoc_status and\nassoc_addr are written by the handler but read by the association path\nwhile the associating bit is still set, so a second response for the same\nrequest - a malicious one, for instance - can replace them between those\nreads and leave the caller with an incoherent status and address pair.\n\nThe response handler only needs the coordinator extended address.\nReplace assoc_dev with a cached address, removing the pointer lifetime\ndependency. Protect the cached address and the associating bit with a\ndedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee\nan atomic __le64 access on all 32-bit architectures.\n\nwpan_dev->association_lock cannot be reused here: nl802154_associate()\nholds it across rdev_associate(), hence for the whole of\nmac802154_perform_association() including the wait for the response.\nA response handler taking that lock would only get it once the\nassociation has already given up.\n\nReset the completion, publish the cached address, and set the associating\nbit while holding the lock. The response handler takes the lock, rechecks\nthe bit and the cached address, records the response, clears the bit, and\nonly then completes the waiter. Thus cleanup cannot pass the handler\nbetween its state check and completion, and the cached 64-bit value\ncannot tear.\n\nThe handler clears the bit before completing, not the woken waiter:\notherwise complete() is issued under the lock and a second (e.g.\nmalicious) response can reacquire it before the waiter and replace the\nresult. So a wait that returns success implies the bit is already clear,\nand the success and negative-response paths return directly. The\ntransmit-error and timeout paths still clear it under assoc_lock, which\nserializes any racing response against the cleanup while the call returns\nthe error it already selected. Both paths snapshot assoc_status and\nassoc_addr under the same lock.\n\nBoth users run in process context, so a plain spinlock is sufficient.\nThe lock is not held while waiting for the completion.","Type":"Description","Title":"mac802154: fix data race and NULL deref on local->assoc_dev"}]}}}