PT-2026-117029

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue ieee80211 monitor select queue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However,...

PT-2026-116923

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

PT-2026-117041

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211 build hdr, ieee80211 lookup ra sta uses sta info get bss for all AP and AP VLAN frames, not only for control port...

PT-2026-116927

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace ctx pointers between the old WILL BE REPLACED chanctx and the new REPLACES OTHER chanctx. However, the early free paths only consider...

PT-2026-117048

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extra len overflow In ieee80211 rx h defragment, fragment payloads are accumulated into entry-extra len as subsequent fragments arrive: entry-extra len += rx-skb-len; When the fin...

PT-2026-116919

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info-band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee80211 8023 xmit does not set info-band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211 get tx rates uses the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Do not return “unset power” in ieee80211gettxpower. We may receive a UBSAN warning if ieee80211gettxpower returns the INTMIN value that mac80211 internally uses for “unset power level”. UBSAN:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211: Purge vif txq in ieee80211dostop After ieee80211dostop, the packets from vif’s txq could still be processed. Indeed, another concurrent call to scheduleandwaketxq from vif could cause those packets to be dequeued...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fixed a UAF in ieee80211scanrx The ieee80211scanrx function attempts to access scanreq-flags after a null check. However, a UAF Use-after-Allocation was observed when the scan is completed and ieee80211scancomplet...

PT-2026-106661

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the mac80211 wifi component where the ieee80211 tdls oper function can incorrectly operate on the AP station instead of exclusively on TDLS peers. This confusion can lead...

PT-2026-106521

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A use-after-free issue exists in the wcn36xx wifi driver. The wcn36xx dxe deinit function uses timer delete to tear down the TX ack timer, which dequeues the timer but does not wait for any...

PT-2026-106663

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the mac80211 wireless driver where the ieee80211 start ap function may fail after setting the enable beacon and beacon int variables, leaving them in an inconsistent stat...

PT-2026-98130

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access issue exists in the mac80211 wifi component. In Neighbor Awareness Networking NAN, the info-band variable is set to NUM NL80211 BANDS because the transmission ban...

PT-2026-98004

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ieee80211 ibss disconnect function within the mac80211 module during the process of leaving an Independent Basic Service Set IBSS. The system flushes...

PT-2026-104903

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't call ieee80211 handle reconfig failure when not needed In case reconfiguration of NAN fails, we call ieee80211 handle reconfig failure, that marks all interfaces as not in the driver. Then, at the error path...

CVE-2026-56101

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...

CVE-2026-56101 OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...

CVE-2026-56101 OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...

PT-2026-86715

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211 process rx twt action only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211...

SUSE CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...