CVE-2026-17054 Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

The Espressif ESP-hosted Wi-Fi driver drivers/wifi/esphosted/ parses frames received over SPI from the ESP co-processor in esphostedeventtask. For control frames it took the 16-bit TLV field datalength straight off the wire and passed it to pbistreamfrombufferframe.datavalue, frame.datalength...

CVE-2026-17054: Out-of-bounds Read

The Espressif ESP-hosted Wi-Fi driver drivers/wifi/esphosted/ parses frames received over SPI from the ESP co-processor in esphostedeventtask. For control frames it took the 16-bit TLV field datalength straight off the wire and passed it to pbistreamfrombufferframe.datavalue, frame.datalength...

PT-2026-96273

Name of the Vulnerable Software and Affected Versions Espressif ESP-hosted Wi-Fi driver affected versions not specified Description The driver parses frames received over SPI from the ESP co-processor in the esp hosted event task function. For control frames, the driver uses the 16-bit TLV field...

PT-2026-94727

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7921 Wi-Fi driver where a PCIe Advanced Error Reporting AER error can cause the bus to hang. When this occurs, register reads return 0xFFFFFFFF, which corrupts t...

kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash

A flaw was found in the ath9k Wi-Fi driver in the Linux kernel. A race condition exists during the asynchronous firmware loading process and device disconnection. A local attacker, by repeatedly connecting and disconnecting a malicious USB Wi-Fi device that fails firmware download, could trigger ...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ALSA-2026:67468 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address CVE-2025-71127 kernel: KVM: nSVM: Always use vmcb01 in...

CVE-2026-80941

A flaw was found in the rtw88 Wi-Fi driver of the Linux kernel. This issue occurs because the rtwtxqpushskb function fails to free a socket buffer skb when an error occurs during transmission. This oversight can lead to a memory leak, potentially impacting system stability and performance over ti...

CVE-2026-80949

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. The memory allocated for a buffer is not properly released in certain error handling paths within the brcmfsdioreadcontrol function. This improper memory management can lead to a memory leak, potentially causing system instability or a...

CVE-2026-80937

A flaw was found in the Linux kernel's Wi-Fi driver for mt7915 chipsets. This vulnerability allows a malicious or malfunctioning Wi-Fi device to provide an invalid memory address. This can cause the driver to write data beyond its allocated memory, leading to an out-of-bounds write. Such memory...

CVE-2026-89523

A flaw was found in the Linux kernel's MediaTek mt7925 Wi-Fi driver. When the device is reset, suspended, or unregistered, a pending work item mlopmwork can continue to execute. This can lead to the work item accessing memory that has already been freed a use-after-free vulnerability or sending...

CVE-2026-80933

A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. This vulnerability occurs because the driver does not properly validate the size of the default EEPROM Electrically Erasable Programmable Read-Only Memory firmware. A specially crafted, truncated EEPROM firmware file can cause the...

CVE-2026-80944

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When a synchronous command's wait operation is interrupted, the driver can attempt to write data to a memory location that has already been released. This memory corruption can lead to a system crash kernel panic, resulting in a Denial ...

CVE-2026-80934

A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. The driver incorrectly manages Direct Memory Access DMA mappings when processing AddBA request frames, causing a continuous leak of these mappings. Over time, this resource exhaustion can lead to a Denial of Service DoS for the Wi-...

CVE-2026-80935

A flaw was found in the Linux kernel's Wi-Fi driver for MediaTek MT7996 devices. A malicious or malfunctioning Wi-Fi device can exploit improper validation of an EEPROM Electrically Erasable Programmable Read-Only Memory address during a copy operation. This can lead to an out-of-bounds write,...

kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

A flaw was found in the Linux kernel. The mt7925 Wi-Fi driver incorrectly dispatches a memory-mapped I/O MMIO specific event to non-MMIO buses, such as USB. This improper handling leads to a NULL pointer dereference when attempting to clean up DMA transmit queues. A remote attacker could exploit...

kernel: wifi: mt76: mt7925: fix crash in reset link replay

A flaw was found in the MediaTek mt7925 Wi-Fi driver within the Linux kernel. During a reset recovery process, the driver can attempt to access a network configuration that no longer exists. This can lead to a null pointer dereference, causing the system to crash and resulting in a Denial of...

CVE-2026-80632

A flaw was found in the Linux kernel's Wi-Fi driver, specifically within the mt7996 component. When the MT76NPU and CONFIGNETMEDIATEKSOCWED configurations are enabled and the Airoha NPU System-on-Chip SoC is detected, the mt7996inittxqueues function can attempt to dereference a NULL Wi-Fi/Etherne...

CVE-2026-80635

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability occurs because the driver does not adequately validate the length of certain firmware responses. An attacker could potentially craft a malicious firmware response, leading to an out-of-bounds read of stale heap data...

CVE-2026-74648

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. This vulnerability occurs because the rtwcfg80211monitorifxmitentry function does not properly validate the length of monitor transmit frames after processing. A remote attacker could exploit this by sending a specially crafted,...