CVE-2026-98341

The Linux kernel 's cfg80211 component is vulnerable to a Use-After-Free (UAF) in scan_done() when an interface goes down during an active scan. The vulnerability occurs because cfg80211 frees the scan request upon completion, but the driver may still believe it owns the request due to the asynch...

CVE-2026-98340

The Linux kernel contains a vulnerability in the cfg80211 WiFi stack where the __cfg80211_bss_update() function incorrectly groups hidden BSSes**. Specifically, it may group a probe response for an unknown BSS with an existing entry that lacks beacon elements, creating a group withou...

EUVD-2026-93325

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

CVE-2026-98339

The Linux kernel contains a vulnerability in the wifi: cfg80211 component where stale BSS entries are not correctly filtered during removal. When an associated Access Point (AP) switches to a channel with an existing BSS entry, the function cfg80211_update_assoc_bss_entry() removes the entry to a...

EUVD-2026-93323

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with...

CVE-2026-98338

The Linux kernel contains a race condition in the cfg80211 wireless subsystem when joining an IBSS . The issue occurs because the system previously recorded only the BSSID/channel and performed a lookup later; however, a new scan with NL80211_SCAN_FLAG_FLUSH could remove the BSS entry before proc...

CVE-2026-98339 wifi: cfg80211: don't filter by BSS type when removing stale entries

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211updateassocbssentry removes that entry before rehashing the real one, since the two...

EUVD-2026-93324

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211updateassocbssentry removes that entry before rehashing the real one, since the two...

CVE-2026-98337

A vulnerability exists in the Linux kernel 's mac80211 wifi subsystem where ROC (Radio Out Channel) work could be started while a scan is in progress. This occurs because pending ROC work might remain when a scan begins, and new ROCs can be added to the list, potentially causing a warning in net/...

EUVD-2026-93322

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts which requires ROC list to be empty, but that's possible, and then a new ROC can be added to the list and the work will pick it up...

EUVD-2026-93321

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't offload TC setup on APVLAN interfaces APVLAN interfaces are purely virtual, so don't try to offload TC setup to drivers. We can't really use the AP interface either since we may not know it all the time, and...

CVE-2026-98336

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the system attempts to offload TC (traffic control) setup to drivers for AP_VLAN interfaces . Because these interfaces are purely virtual, the offload attempt is inappropriate and can fail as the AP interface may be u...

EUVD-2026-93320

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...

CVE-2026-98335

The Linux kernel contains a vulnerability in the mac80211 wifi subsystem where the ieee80211_stop_mesh() function fails to properly abort a channel switch (CSA) when leaving a mesh. Because the function leaves CSA active while releasing the channel context, it results in a null-pointer dereferenc...

CVE-2026-98333

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the radio LED state is not properly reset if the interface bringing up fails. This oversight allows the TPT trigger timer to continue running indefinitely even after a failure, eventually leading to a use-after-free c...

CVE-2026-98334

A vulnerability exists in the Linux kernel 's mac80211 WiFi subsystem where the ieee80211_start_ap() function can set enable_beacon and beacon_int but fail to reset them upon an error. This persistent state can cause a divide error (Oops) in hwsim when scanning attempts to restore beaconing. Addi...

EUVD-2026-93319

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211startap can set enablebeacon and beaconint and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops:...

EUVD-2026-93318

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running. But if bringing up the interface fails then the tim...

CVE-2026-98332

The Linux kernel contains a vulnerability in the wifi: mac80211 component. The function ieee80211_tdls_oper() can incorrectly operate on an AP station if it is confused for a TDLS peer . This leads to various warnings when the AP station is subsequently removed or at a later point in time. The fi...

EUVD-2026-93317

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211tdlsoper can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused...