EUVD-2026-103963

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

CVE-2026-98708

The Linux kernel contains a vulnerability in the wifi: mac80211 component where a chanctx (channel context) could be freed prematurely. The issue occurs because early free paths only consider assigned and reserved link users, allowing an old WILL_BE_REPLACED chanctx to be freed while its replacem...

EUVD-2026-103962

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

CVE-2026-98708 wifi: mac80211: keep paired old chanctx alive

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

CVE-2026-98708 wifi: mac80211: keep paired old chanctx alive

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

CVE-2026-98707

The Linux kernel 's wifi: mac80211 component is vulnerable to a memory corruption issue during the teardown of an RX BA session . A race condition occurs when an RX BAR handler holds a reference to tid_rx under RCU; if the teardown process deletes the session timer while the handler is still in t...

CVE-2026-98707 wifi: mac80211: shut down RX BA session timer on teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

EUVD-2026-103961

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

CVE-2026-98707 wifi: mac80211: shut down RX BA session timer on teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

EUVD-2026-103960

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98706

The Linux kernel contains a vulnerability in the mac80211 wifi driver related to station teardown. Removing an AP or mesh station can trigger a race condition where the driver notifies the driver and wakes TXQs after the station has been removed, potentially updating num_sta_ps and power-save que...

CVE-2026-98706 wifi: mac80211: drain PS delivery work during station teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98706 wifi: mac80211: drain PS delivery work during station teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98705 wifi: mac80211: account proxy paths against the mesh path limit

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

EUVD-2026-103959

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

CVE-2026-98705

The Linux kernel contains a vulnerability in the wifi: mac80211 component where proxy-path churn can drive the interface path counter into negative values. This occurs because mesh_path_free_rcu() decrements the counter for proxy paths, but mpp_path_add() fails to reserve a slot in that counter, ...

CVE-2026-98705 wifi: mac80211: account proxy paths against the mesh path limit

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

CVE-2026-98704 wifi: mac80211: keep fallback association elements alive

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

EUVD-2026-103958

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...