PT-2026-72941

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tid tx use-after-free on BA session stop ieee80211 stop tx ba cb hands tid tx to kfree rcu through ieee80211 remove tid tx, and then reads tid tx-ndp after dropping sta-lock: ieee80211 remove tid txsta, tid; /...

PT-2026-72772

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211 s1g check tim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee802 11 parse elems full store...

PT-2026-72193

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211 register hw If kmemdup fails while copying supported band structures, the error path jumps to fail rate. This skips rate control deinitialize and leaks the initialized local-rate ctrl...

PT-2026-72802

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change sta links for unready link ieee80211 set active links calls ieee80211 link use channel for each newly-added link and WARN ON ONCEs if it fails. The call uses assign on failure=true, which...

PT-2026-72758

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996 mac write txwi 80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211 tx info. Check vif...

Linux Distros Unpatched Vulnerability : CVE-2026-68470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX pa...

SUSE CVE-2026-68405

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

The vulnerability in the mac80211/rx.c component of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability in the mac80211/rx.c component of the Linux operating system’s kernel is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the mac80211/ocb.c component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the mac80211/ocb.c component in the Linux operating system is related to improper handling of the absence of a specific element. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

CVE-2026-68405

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. When stopping an Access Point AP VLAN, the system attempts to free network packet buffers SKBs while interrupts are disabled. This improper handling can lead to a situation where network transmission operations occur in an...

CVE-2026-68409

A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO Multi-Link Operation link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU Read-Copy-Update. This timing issue can lead to a use-after-free vulnerability,...

AZL-95042 CVE-2026-68409 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

DEBIAN-CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

UBUNTU-CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

CVE-2026-68405

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

UBUNTU-CVE-2026-68405

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

CVE-2026-68411

The CVE affects the Linux kernel’s wifi/mac80211_hwsim path. In hwsim_virtio_rx_work(), the virtqueue used-ring length reported by the device could be passed directly to skb_put() on a fixed-size receive skb, allowing skb_over_panic() and a host-triggerable guest panic (DoS) when length exceeds t...