Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-93149

wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • bd18de517923903a177508fc8813f44e717b1c00 to < d131027054a8dd922dda01fe8d381abe5af4970baffected
  • bd18de517923903a177508fc8813f44e717b1c00 to < c40ba47f2ba1951cb32ea048667ed014d36a5749affected
  • bd18de517923903a177508fc8813f44e717b1c00 to < 2817431a61557f46dc63077b7cc126bc906c242eaffected
  • bd18de517923903a177508fc8813f44e717b1c00 to < e7fccad2c8e6ef6bbafe509c95869d161d0f466baffected
  • bd18de517923903a177508fc8813f44e717b1c00 to < 1c2a4ab6efa26415dd131b8c222e7893fda03435affected
  • bd18de517923903a177508fc8813f44e717b1c00 to < 158438cd6ad69d6dd7d871582c38baf22169fedeaffected
  • 78bf3c6131488b00386acd9aff1ea4e6c44fa38eaffected
  • a9028333001f793b2724e8be42fce3336de2cf1caffected
  • 7019c9f385b264a2d6f685028268422d55087e37affected
  • 5.4.129 to < 5.5affected
  • 5.10.47 to < 5.11affected
  • 5.12.14 to < 5.13affected

Linux Linux

Default version status: affected

  • 5.13affected
  • 0 to < 5.13unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References