EUVD-2026-93323

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with...

CVE-2026-98338

The Linux kernel contains a race condition in the cfg80211 wireless subsystem when joining an IBSS . The issue occurs because the system previously recorded only the BSSID/channel and performed a lookup later; however, a new scan with NL80211_SCAN_FLAG_FLUSH could remove the BSS entry before proc...

CVE-2026-98337 wifi: mac80211: don't start a ROC while scanning

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts which requires ROC list to be empty, but that's possible, and then a new ROC can be added to the list and the work will pick it up...

CVE-2026-98337

A vulnerability exists in the Linux kernel 's mac80211 wifi subsystem where ROC (Radio Out Channel) work could be started while a scan is in progress. This occurs because pending ROC work might remain when a scan begins, and new ROCs can be added to the list, potentially causing a warning in net/...

EUVD-2026-93322

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts which requires ROC list to be empty, but that's possible, and then a new ROC can be added to the list and the work will pick it up...

EUVD-2026-93321

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't offload TC setup on APVLAN interfaces APVLAN interfaces are purely virtual, so don't try to offload TC setup to drivers. We can't really use the AP interface either since we may not know it all the time, and...

CVE-2026-98336

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the system attempts to offload TC (traffic control) setup to drivers for AP_VLAN interfaces . Because these interfaces are purely virtual, the offload attempt is inappropriate and can fail as the AP interface may be u...

EUVD-2026-93320

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...

CVE-2026-98335

The Linux kernel contains a vulnerability in the mac80211 wifi subsystem where the ieee80211_stop_mesh() function fails to properly abort a channel switch (CSA) when leaving a mesh. Because the function leaves CSA active while releasing the channel context, it results in a null-pointer dereferenc...

CVE-2026-98334

A vulnerability exists in the Linux kernel 's mac80211 WiFi subsystem where the ieee80211_start_ap() function can set enable_beacon and beacon_int but fail to reset them upon an error. This persistent state can cause a divide error (Oops) in hwsim when scanning attempts to restore beaconing. Addi...

CVE-2026-98333

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the radio LED state is not properly reset if the interface bringing up fails. This oversight allows the TPT trigger timer to continue running indefinitely even after a failure, eventually leading to a use-after-free c...

EUVD-2026-93319

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211startap can set enablebeacon and beaconint and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops:...

EUVD-2026-93318

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running. But if bringing up the interface fails then the tim...

EUVD-2026-93317

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211tdlsoper can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused...

CVE-2026-98332

The Linux kernel contains a vulnerability in the wifi: mac80211 component. The function ieee80211_tdls_oper() can incorrectly operate on an AP station if it is confused for a TDLS peer . This leads to various warnings when the AP station is subsequently removed or at a later point in time. The fi...

CVE-2026-98331

The Linux kernel contains a vulnerability in the mac80211 wifi driver where virtual interfaces (vifs) may remain in the local->interfaces list after their network device is unregistered. This occurs specifically when a wiphy held in a network namespace is destroyed and fails to move to the ini...

EUVD-2026-93316

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local-interfaces list when an interface is removed via ieee80211ifremove, before it unregisters the netdev. However, it's possible...

CVE-2026-98331 wifi: mac80211: unlist vifs when their netdev is unregistered

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local-interfaces list when an interface is removed via ieee80211ifremove, before it unregisters the netdev. However, it's possible...

EUVD-2026-93315

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211pernetexit moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fai...

CVE-2026-98330 wifi: cfg80211: get the wiphy out of a dying network namespace

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211pernetexit moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fai...