EUVD-2026-93311

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

CVE-2026-98326

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

CVE-2026-98326 wifi: mac80211: mesh: release the channel if start fails

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

CVE-2026-98325 wifi: mac80211: set up the TX info early to fix failure paths

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

EUVD-2026-93310

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98325 wifi: mac80211: set up the TX info early to fix failure paths

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98325

The Linux kernel contains a vulnerability in the wifi: mac80211 component where failed socket buffer (SKB) structures were not properly reported to userspace during certain failure paths. The issue stems from the timing of TX information setup; specifically, the skb->cb[] array was not initial...

CVE-2026-98325

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98183 wifi: mac80211: avoid out-of-bounds read for empty PREQ elements

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...

CVE-2026-98183

The Linux kernel contains a vulnerability in the wifi: mac80211 component where an out-of-bounds read occurs during the processing of PREQ elements . The root cause is that the function ieee80211_mesh_preq_size_ok() derives the location of bottom fields before verifying if the element contains a ...

EUVD-2026-93111

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...

CVE-2026-98183 wifi: mac80211: avoid out-of-bounds read for empty PREQ elements

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...

CVE-2026-98183

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...

EUVD-2026-93110

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...

CVE-2026-98182

The Linux kernel contains a vulnerability in the mac80211 wifi stack where setting a monitor interface to active on a down interface results in a kernel NULL pointer dereference . The issue occurs because a monitor interface only receives a TXQ if created active; however, the system still allows ...

CVE-2026-98182 wifi: mac80211: refuse to make a monitor active when it has no queue

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...

CVE-2026-98182 wifi: mac80211: refuse to make a monitor active when it has no queue

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...

CVE-2026-98182

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...

CVE-2026-98346: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

CVE-2026-98325: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...