In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
mac80211_hwsim_stop() drops any frames left in data->pending. The loop
currently checks skb_queue_empty() and then dequeues separately.
That split is racy with TX status handling, which can remove a pending
frame under the queue lock. If the last entry is removed after the empty
check, skb_dequeue() returns NULL and the stop path passes that NULL skb
to ieee80211_free_txskb().
Use skb_dequeue() as the loop condition instead. The dequeue result is the
object that stop owns and frees, and a concurrent status completion that
empties the queue simply makes the loop terminate.
CVSS
No CVSS.
References
Configurations
No configuration.
History
17 Sep 2026, 17:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-17 17:18
Updated : 2026-09-17 17:18
NVD link : CVE-2026-93149
Mitre link : CVE-2026-93149
CVE.ORG link : CVE-2026-93149
JSON object : View
Products Affected
No product.
CWE
No CWE.