EUVD-2026-93125

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...

CVE-2026-98196

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the brcmsmac WiFi driver. The issue resides in the brcms_free_timer() function, which calls brcms_del_timer() using the non-synchronous cancel_delayed_work() . If the _brcms_timer callback is already executing, the cancellation...

EUVD-2026-93124

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcmsfreetimer brcmsfreetimer calls brcmsdeltimer which uses the non-synchronous canceldelayedwork to cancel the timer's underlying delayed work. If the work callback brcmstimer is already running,...

CVE-2026-98195

The Linux kernel contains a vulnerability in the wifi: iwlegacy component related to how broadcast stations are deallocated. Specifically, in the error path of __il4965_up(), the function il_dealloc_bcast_stations() incorrectly clears only the IL_STA_UCODE_ACTIVE flag while leaving IL_STA_BCAST s...

EUVD-2026-93123

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

EUVD-2026-93122

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

CVE-2026-98194

A Use-After-Free (UAF) vulnerability exists in the Linux kernel within the wifi: libertas_tf component. The issue is caused by the lbtf_free_adapter() function calling lbtf_free_cmd_buffer() to free command buffers before executing timer_delete_sync(). If the command_timer_fn callback is active d...

CVE-2026-98193

The Linux kernel contains a vulnerability in the libipw component where the libipw_michael_mic_verify() function incorrectly assumes the presence of an eight-byte Michael MIC. A short TKIP frame can cause the unsigned payload length to wrap, leading to an out-of-bounds read as michael_mic() reads...

EUVD-2026-93121

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipwmichaelmicverify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michaelmic to read past the skb...

EUVD-2026-93120

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

EUVD-2026-93119

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcoreregdomainconfig gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked fails, the function queues...

CVE-2026-98192

The Linux kernel contains a potential use-after-free vulnerability in the wcn36xx wifi driver during the TX ack timer teardown. The wcn36xx_dxe_deinit() function uses timer_delete(), which dequeues the timer but fails to wait for a callback already in execution. Consequently, the wcn36xx_dxe_tx_t...

CVE-2026-98191

The Linux kernel contains a vulnerability in the wifi: wlcore component related to runtime power management. The function wlcore_regdomain_config() acquires a runtime PM reference before sending a regulatory-domain command. However, when wlcore_cmd_regdomain_config_locked() fails, the function qu...

CVE-2026-98190

The Linux kernel (specifically the wilc1000 driver) contains an out-of-bounds read vulnerability in the processing of P2P public action frames . The issue arises because ieee80211_is_public_action() only verifies a minimum length of 25 bytes, while the subsequent parsing in wilc_wfi_p2p_rx() and ...

EUVD-2026-93118

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

CVE-2026-98189

The Linux kernel contains an Out-of-Bounds (OOB) write vulnerability in the wilc1000 wifi driver within the wilc_wlan_handle_isr_ext() function. The driver fails to validate the RX transfer size reported by the device's interrupt status register (up to 131,068 bytes) against the rx_buffer size, w...

EUVD-2026-93117

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...

EUVD-2026-93116

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54convertrev0 and p54convertrev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

CVE-2026-98188

The Linux kernel contains an out-of-bounds read vulnerability in the wifi: p54 driver. The functions p54_convert_rev0() and p54_convert_rev1() fail to validate the length of calibration curve data read from a device-supplied EEPROM entry . Specifically, the functions use channel and points-per-ch...

CVE-2026-98187

A vulnerability exists in the Linux kernel 's wifi: p54 driver. The PDR_INTERFACE_LIST loop fails to verify that a full exp_if record fits within its entry before reading, allowing a truncated trailing record to cause reads to cross entry boundaries into the heap beyond the EEPROM buffer. This fl...