CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiexpcierequestirq registers each MSI-X vector with a per-index devid &card-msixctxi. On a requestirq failure the cleanup loop "for j = 0; j msixctxi as the...

CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrtcount after the previous drop, using the configured interval codelparams.interval. For very small intervals...

CVE-2026-98426

A vulnerability exists in the Linux kernel 's mwifiex Wi-Fi driver. The mwifiex_pcie_request_irq() function incorrectly handles MSI-X vector registration; when request_irq() fails, the cleanup loop passes the incorrect dev_id to free_irq(). This mismatch causes previously requested IRQs to remain...

CVE-2026-98427

A vulnerability exists in the Linux kernel 's net/sched subsystem involving the CoDel (Controlled Delay) control law. When configured with very small intervals (e.g., 2us), the scheduled dropping step rounds down to zero, causing the dropping loop in codel_dequeue() to never advance. This allows ...

CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiexpcierequestirq registers each MSI-X vector with a per-index devid &card-msixctxi. On a requestirq failure the cleanup loop "for j = 0; j msixctxi as the...

EUVD-2026-101075

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiexpcierequestirq registers each MSI-X vector with a per-index devid &card-msixctxi. On a requestirq failure the cleanup loop "for j = 0; j msixctxi as the...

CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when an IBSS has no channel to scan ieee80211requestibssscan warns when regulatory leaves no allowed channel, but that can happen as the regdomain can change while IBSS is operating, and it can continue...

CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when an IBSS has no channel to scan ieee80211requestibssscan warns when regulatory leaves no allowed channel, but that can happen as the regdomain can change while IBSS is operating, and it can continue...

CVE-2026-98425

The Linux kernel contains a vulnerability in the mac80211 WiFi subsystem where the function ieee80211_request_ibss_scan() issues an unnecessary warning when regulatory domains leave no allowed channels for an IBSS. This occurs because the regdomain can change while an IBSS is operating, allowing ...

EUVD-2026-101074

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when an IBSS has no channel to scan ieee80211requestibssscan warns when regulatory leaves no allowed channel, but that can happen as the regdomain can change while IBSS is operating, and it can continue...

EUVD-2026-101073

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once all the interfaces have been moved, cfg80211switchnetns moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. T...

CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once all the interfaces have been moved, cfg80211switchnetns moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. T...

CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once all the interfaces have been moved, cfg80211switchnetns moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. T...

EUVD-2026-101072

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: don't hand frames to mac80211 while stopping The code checks -started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the...

CVE-2026-98423 wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: don't hand frames to mac80211 while stopping The code checks -started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the...

CVE-2026-98424

The Linux kernel contains a vulnerability in the cfg80211 component where the cfg80211_switch_netns() function fails to handle errors during the wiphy renaming process. When renaming the wiphy fails due to allocation errors, the component can leave the system in an inconsistent state where object...

CVE-2026-98423

The Linux kernel contains a vulnerability in the wifi: mac80211_hwsim component where frames from wmediumd could be handed to mac80211 while the radio is stopping. This occurs because the code checks the ->started status, but the radio can be stopped immediately after that check but before fra...

CVE-2026-98423 wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: don't hand frames to mac80211 while stopping The code checks -started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the...

CVE-2026-98421

The Linux kernel contains a vulnerability in the wifi: mac80211 component regarding TDLS setup confirm . The issue occurs because the system may attempt to send a setup confirm to a station that does not exist, triggering a WARN_ON_ONCE(!sta || !ap_sta) warning during frame construction. To resol...

CVE-2026-98422

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the AP_VLAN tailroom counter is not properly managed. Specifically, on ifup , AP_VLAN interfaces inherit the crypto_tx_tailroom_needed_cnt from the AP interface, but this counter is never decremented unless the AP its...