CVE-2026-98351

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

CVE-2026-98350

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: pass PMKID to firmware if present Zero out authstatus on initialization. Otherwise, garbage will leak from the stack to the firmware when ssid is less than 32 bytes and/or when params-pmkid is set. Then, pass...

CVE-2026-98347

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98345

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98344

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

CVE-2026-98343

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

CVE-2026-98342

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...

CVE-2026-98340

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

CVE-2026-98338

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with...

CVE-2026-98339

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211updateassocbssentry removes that entry before rehashing the real one, since the two...

CVE-2026-98337

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts which requires ROC list to be empty, but that's possible, and then a new ROC can be added to the list and the work will pick it up...

CVE-2026-98336

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't offload TC setup on APVLAN interfaces APVLAN interfaces are purely virtual, so don't try to offload TC setup to drivers. We can't really use the AP interface either since we may not know it all the time, and...

CVE-2026-98334

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211startap can set enablebeacon and beaconint and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops:...

CVE-2026-98333

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running. But if bringing up the interface fails then the tim...

CVE-2026-98331

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local-interfaces list when an interface is removed via ieee80211ifremove, before it unregisters the netdev. However, it's possible...

CVE-2026-98330

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211pernetexit moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fai...

CVE-2026-98329

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual...

CVE-2026-98328

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

CVE-2026-98327

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...