CVE-2026-93149

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:18:10.083000

Last modified

2026-10-19 10:17:05.050000

View original CVE JSON

{
  "id": "CVE-2026-93149",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:18:10.083",
  "lastModified": "2026-10-19T10:17:05.050",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: avoid NULL skb in stop queue drain\n\nmac80211_hwsim_stop() drops any frames left in data->pending. The loop\ncurrently checks skb_queue_empty() and then dequeues separately.\n\nThat split is racy with TX status handling, which can remove a pending\nframe under the queue lock. If the last entry is removed after the empty\ncheck, skb_dequeue() returns NULL and the stop path passes that NULL skb\nto ieee80211_free_txskb().\n\nUse skb_dequeue() as the loop condition instead. The dequeue result is the\nobject that stop owns and frees, and a concurrent status completion that\nempties the queue simply makes the loop terminate."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "d131027054a8dd922dda01fe8d381abe5af4970b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "c40ba47f2ba1951cb32ea048667ed014d36a5749",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "2817431a61557f46dc63077b7cc126bc906c242e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "e7fccad2c8e6ef6bbafe509c95869d161d0f466b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "1c2a4ab6efa26415dd131b8c222e7893fda03435",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "158438cd6ad69d6dd7d871582c38baf22169fede",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "78bf3c6131488b00386acd9aff1ea4e6c44fa38e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "a9028333001f793b2724e8be42fce3336de2cf1c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7019c9f385b264a2d6f685028268422d55087e37",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5.4.129",
              "lessThan": "5.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.10.47",
              "lessThan": "5.11",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.12.14",
              "lessThan": "5.13",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.13",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.13",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.110",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}