Lucene search
+L

13258 matches found

Cvelist
Cvelist
•added 2026/08/15 5:58 a.m.•37 views

CVE-2026-74367 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

7.8CVSS0.00165EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/15 5:58 a.m.•13 views

CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

5.6AI score
SaveExploits0References6
EUVD
EUVD
•added 2026/08/15 5:58 a.m.•17 views

EUVD-2026-59513

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

5.5AI score0.00206EPSS
SaveExploits0References3
attackerkb
attackerkb
•added 2026/08/15 5:58 a.m.•21 views

CVE-2026-74366

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

5.3AI score0.00206EPSS
SaveExploits0References4Affected Software1
CVE
CVE
•added 2026/08/15 5:58 a.m.•47 views

CVE-2026-74366

CVE-2026-74366 concerns a NULL dereference in the Linux kernel’s ath12k wifi driver when handling unready links. The issue occurs because a path that validates a MAC channel may not create the vdev, leaving arvif->is_created as false and arvif->ar NULL. Subsequent code paths allocate an ars...

5.5AI score0.00206EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/08/15 5:58 a.m.•35 views

CVE-2026-74340 wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

8.1CVSS0.00419EPSS
SaveExploits0References8
OSV
OSV
•added 2026/08/15 5:58 a.m.•25 views

CVE-2026-74336 wifi: mac80211: bound S1G TIM PVB walk to the TIM element

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

5.5AI score
SaveExploits0References5
CVE
CVE
•added 2026/08/15 5:58 a.m.•51 views

CVE-2026-74325

CVE-2026-74325 concerns the Linux kernel’s mt76 Wi-Fi driver. The fix replaces a plain kfree() with kfree_rcu() for the offchannel mlink object in mt76_put_vif_phy_link to ensure memory is not freed while still potentially accessed under RCU. The root cause is that rcu_assign_pointer(NULL) only p...

7.8CVSS5.2AI score0.00173EPSS
SaveExploits0References3
CVE
CVE
•added 2026/08/15 5:58 a.m.•39 views

CVE-2026-74326

The CVE-2026-74326 entry describes a resource leak in the Linux kernel WiFi subsystem for the mt76 mt7921 driver. If pcim_iomap_region() or devm_kmemdup() fail during probe, the code returns without cleaning up previously allocated resources, specifically the mt76_device created by mt76_alloc_dev...

5.4AI score0.00198EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/15 5:58 a.m.•31 views

CVE-2026-74325 wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

7.8CVSS5.3AI score
SaveExploits0References6
EUVD
EUVD
•added 2026/08/15 5:58 a.m.•17 views

EUVD-2026-59470

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of...

5.3AI score0.00375EPSS
SaveExploits0References3
OSV
OSV
•added 2026/08/15 5:58 a.m.•37 views

CVE-2026-74323 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of...

8.8CVSS5.4AI score
SaveExploits0References6
Cvelist
Cvelist
•added 2026/08/15 5:58 a.m.•35 views

CVE-2026-74323 wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996txprepareskb If linkconf or linksta lookup fails in mt7996txprepareskb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in case of...

8.8CVSS0.00375EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/08/15 5:58 a.m.•15 views

EUVD-2026-59469

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

5.4AI score0.00206EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/08/15 5:58 a.m.•36 views

CVE-2026-74322 wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

0.00206EPSS
SaveExploits0References3
OSV
OSV
•added 2026/08/15 5:58 a.m.•19 views

CVE-2026-74322 wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

5.5AI score
SaveExploits0References6
OSV
OSV
•added 2026/08/15 5:52 a.m.•18 views

CVE-2026-72070 wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix use-after-free in lbtffreeadapter lbtffreeadapter calls timerdelete&priv-commandtimer, which does not wait for a running commandtimerfn callback. lbtffreeadapter runs on the teardown path right before...

5.6AI score
SaveExploits0References11
CVE
CVE
•added 2026/08/15 5:51 a.m.•60 views

CVE-2026-68471

The CVE-2026-68471 entry describes a Linux kernel Wi-Fi (ieee80211) vulnerability in MLE length validation. The root cause is that ieee80211_mle_common_size() used the first common-info octet as the length for all MLE types, while ieee80211_mle_size_ok() only validated that octet for Basic, Probe...

8.8CVSS5.3AI score0.00375EPSS
SaveExploits0References3
OSV
OSV
•added 2026/08/15 5:51 a.m.•30 views

CVE-2026-68471 wifi: ieee80211: validate MLE common info length

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

8.8CVSS5.4AI score
SaveExploits0References6
OSV
OSV
•added 2026/08/15 5:51 a.m.•21 views

CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

8.8CVSS5.6AI score
SaveExploits0References5
Rows per page
Query Builder