rtl8xxxu_probe Realtek wireless driver Use-After-Free

The vulnerability of the rtl8xxxuprobe function in the drivers/net/wireless/realtek/rtl8xxxu/core.c file of the Realtek wireless adapter driver for the Linux operating system is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a remot...

mediatek Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the mt7925macwritetxwi80211 function in the drivers/net/wireless/mediatek/mt76/mt7925/mac.c file of the wireless adapter driver module from mediatek’s Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could...

mediatek Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the mt7996macwritetxwi80211 function in the drivers/net/wireless/mediatek/mt76/mt7996/mac.c file of the wireless adapter driver module from mediatek’s Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could...

MINI-F4FX-MX4R-2W4G

Bulletin has no description...

CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-72024

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

CVE-2026-72003

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

EUVD-2026-59472

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

CVE-2026-72070

CVE-2026-72070 affects the Linux kernel driver for libertas_tf (wifi) and describes a use-after-free in lbtf_free_adapter(). The issue arises because lbtf_free_adapter() calls timer_delete(&priv->command_timer) in teardown, which does not wait for an in-flight command_timer_fn() callback that ...

CVE-2026-72003 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

PT-2026-72849

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the rtw89 wifi driver, an issue exists in the Advanced Error Reporting AER handlers. The driver stores an ieee80211 hw pointer using pci set drvdata during probe time, but the io erro...

PT-2026-72213

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mac802154 module where the bulk hardware teardown path removes entries using list del. Because queue wake, stop, and disable paths traverse local-interfaces under...

Linux Distros Unpatched Vulnerability : CVE-2026-68471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE type...

MINI-RGPR-299R-V6RF

Bulletin has no description...

Linux wireless wext-core Heap Buffer Overflow

The vulnerability of the wireless/wext-core.c component in the Linux operating system is related to the lack of initialization for that resource. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

Linux wireless/realtek/rtw88/rtw8822b.c DoS

The vulnerability of the wireless/realtek/rtw88/rtw8822b.c component of the Linux operating system is related to incomplete recognition of its internal state. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-68404

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedd...

Linux wireless tx.c DoS

The vulnerability of the wireless/ti/wlcore/tx.c component in the Linux operating system is related to a violation of the buffer boundary. Exploiting this vulnerability can allow an attacker to cause a service failure...

Intel PROSet/Wireless WiFi Software Advisory - Lenovo Support US

No description provided...

Linux brcm80211 Driver Buffer Overflow DoS

The vulnerability of the drivers/net/wireless/broadcom/brcm80211/brcmfmac component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...