CVE-2026-68413

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100pciinitone The memory allocated in the ipw2100allocdevice function is not freed in some of the error paths in ipw2100pciinitone. Fix that by converting the direct return into a...

UBUNTU-CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

UBUNTU-CVE-2026-68413

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100pciinitone The memory allocated in the ipw2100allocdevice function is not freed in some of the error paths in ipw2100pciinitone. Fix that by converting the direct return into a...

UBUNTU-CVE-2026-68311

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of...

UBUNTU-CVE-2026-68307

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

UBUNTU-CVE-2026-68407

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...

UBUNTU-CVE-2026-68309

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

UBUNTU-CVE-2026-68408

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsrfreewk to wiphywork to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211releasepmsr clears the request's nlportid and queues pmsrfreewk to call cfg80211pmsrprocessabort...

CVE-2026-68196

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilcparseassocrespinfo computes the trailing IE length as ieslen = bufferlen - sizeofres; without first checking that bufferlen is at least sizeofstruct...

CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

CVE-2026-68355

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11khalrxmsdulistget When the first entry in msdudetails has a zero buffer address, the code accesses msdudetailsi - 1 with i == 0, causing a buffer underflow. Fix similarly to...

CVE-2026-68311

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of...

CVE-2026-68310

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: guard HE capability lookups mt7915mcubsshetlv and mt7915mcustabfertlv both run after checking HE support, then dereference the HE PHY capability returned by mt76connacgethephycap. That helper can return NULL...

CVE-2026-68306

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68308

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76connacgethephycap mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

UBUNTU-CVE-2026-68412

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

UBUNTU-CVE-2026-68406

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capability bit test using...

UBUNTU-CVE-2026-68373

In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76guessfreq at76guessfreq checks only that the received frame is at least a bare 802.11 header 24 bytes before subtracting the fixed management-body offset: len -= eloff; For both...

UBUNTU-CVE-2026-68310

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: guard HE capability lookups mt7915mcubsshetlv and mt7915mcustabfertlv both run after checking HE support, then dereference the HE PHY capability returned by mt76connacgethephycap. That helper can return NULL...

CVE-2026-68309

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...