CVE-2026-98307

A flaw was found in the Linux kernel's ath11k wireless driver. This vulnerability can lead to a Denial of Service DoS through memory exhaustion. When recovering from a wireless firmware crash, the driver fails to free memory allocated for station statistics. An attacker or anomalous condition...

CVE-2026-98350

A flaw was found in the Linux kernel's Broadcom FullMAC brcmfmac wireless driver. During external Wi-Fi authentication, an uninitialized data structure can leak sensitive kernel stack memory directly to the device firmware when processing short network names or key identifiers. A local user or an...

CVE-2026-98348

A flaw was found in the Linux kernel's libipw wireless driver. An attacker within Wi-Fi range can exploit this flaw by transmitting a malformed, abnormally short association response frame. Due to an improper packet length calculation, the driver performs an out-of-bounds memory read, which can...

CVE-2026-98196

A flaw was found in the Linux kernel's brcmsmac wireless driver. When a timer is released, the driver fails to wait for running background tasks associated with the timer to finish before freeing memory. A local attacker could exploit this race condition to trigger a use-after-free condition,...

CVE-2026-98189

A flaw was found in the Linux kernel's wilc1000 wireless driver. An attacker utilizing a malicious or compromised SDIO Secure Digital Input Output hardware device can cause a Denial of Service DoS or kernel memory corruption by triggering an out-of-bounds write. This issue occurs because the driv...

CVE-2026-98193

A flaw was found in the Linux kernel's libipw wireless driver. When processing Temporal Key Integrity Protocol TKIP network frames, the driver assumes the frame contains a complete Message Integrity Check MIC without verifying that the packet meets the minimum expected length. An attacker within...

CVE-2026-98188

A flaw was found in the Linux kernel's p54 wireless driver. An attacker capable of connecting a malicious wireless device could cause a Denial of Service DoS by triggering a system crash. This issue occurs because the driver fails to validate data length parameters when reading calibration curve...

CVE-2026-98194

A flaw was found in the Linux kernel's Libertas TF wireless driver. During device cleanup, the driver releases command memory buffers before stopping the associated timer callback. This timing issue creates a use-after-free condition where an active timer callback accesses released memory, allowi...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath9k: Fixed a potential array-index-out-of-bounds read in ath9khtctxstatus. The bug occurs when txs-cnt—data from a URB provided by a USB device—is larger than the size of the array txs-txstatus, which is HTCMAXTXSTATUS...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: mvm: Pause TCM when the firmware is stopped Ignoring this issue will cause us to send a host command to the transport module while the firmware is not active, which will trigger a WARNING. bad state = 0 WARNING: CP...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192u: Fixed a deadlock in ieee80211beaconsstop. There is a deadlock in ieee80211beaconsstop, as shown below: Thread 1 | Thread 2 | ieee80211sendbeacon ieee80211beaconsstop | modtimer spinlockirqsave //1 | Wa...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: A bug caused by NULL pointer dereferencing in brcmidmacsglistrw has been fixed. This patch addresses a bug where a NULL pointer dereferencing occurs when a high value of sdsgentry-align is used e.g., 512, and many...

CVE-2026-97442

A flaw was found in the Linux kernel's ath11k wireless driver. When processing incoming Wi-Fi frames, the driver fails to properly validate native Wi-Fi header lengths, allowing packets that exceed expected limits to be processed. An attacker within wireless range could exploit this issue by...

CVE-2026-97541

A flaw was found in the Linux kernel's ath9khtc wireless driver. The driver stores a pointer to a USB device identifier that can be freed after the initial device probe when dynamic device identifiers are used. A local attacker could exploit this use-after-free vulnerability when the driver later...

CVE-2026-98160

A flaw was found in the Linux kernel's rtl8723bs wireless driver. During device initialization error handling, allocated memory is released using an incompatible deallocation routine. A local attacker could exploit this condition during driver initialization failures to cause memory corruption,...

ROS-20260928-73-0102

The vulnerability of the drivers/net/wireless/broadcom/brcm80211/brcmfmac component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260924-73-0035

The vulnerability of the iwlagnsendstakey function in the drivers/net/wireless/intel/iwlwifi/dvm/sta.c file of the Intel wireless driver for the Linux operating system is related to a stack-based buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the...

ROS-20260918-73-0121

The vulnerability of the rsimac80211attach function in the drivers/net/wireless/rsi/rsi91xmac80211.c driver for wireless communication adapters in the Linux kernel is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to...

PT-2026-94704

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mt7996 wireless driver. The function mt7996 mac reset vif iter queues non-default virtual interface vif links for kfree rcu while the dev-wcid array...

PT-2026-94701

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the mt7915 wireless driver. When mt7915 register ext phy succeeds but a subsequent failure occurs in mt7915 init debugfs or mt7915 coredump register, the...