CVE-2026-98423

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping The code checks ->started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the WARN_ON(!local->started). Expand the mutex for this case and synchronise against it when the radio is stopped to avoid being able to hit the warning with hwsim. Drop the error print that would've complicated the error path, it only triggers for allocation failures (already noisy) and malformed frames anyway.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-14 14:17:53.880000

Last modified

2026-10-19 10:18:47.930000

View original CVE JSON

{
  "id": "CVE-2026-98423",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-14T14:17:53.880",
  "lastModified": "2026-10-19T10:18:47.930",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: don't hand frames to mac80211 while stopping\n\nThe code checks ->started for frames coming from wmediumd, but the\nradio can be stopped after the check and before frame delivery,\ncausing mac80211 to hit the WARN_ON(!local->started).\n\nExpand the mutex for this case and synchronise against it when the\nradio is stopped to avoid being able to hit the warning with hwsim.\n\nDrop the error print that would've complicated the error path, it\nonly triggers for allocation failures (already noisy) and malformed\nframes anyway."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "lessThan": "5ce9b2bc9e73213e316a8c72400256a76bf41814",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "lessThan": "c4e4fe330294e3936e0f4e15d6996468f8a45fb2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "lessThan": "2f59be7585dc81baa6f36b0035dd6848ea43d318",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "lessThan": "5c79ef616aa16af582fb2cb93b0f750975a0004f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "lessThan": "d7fa45d8123a7f794b93fc22dbcf19f38dc4d8cb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "lessThan": "87840d4a3a21b1c19b867a80e16ba69dff284de2",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.1",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.1",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.189",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.158",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.112",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.54",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.8",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2f59be7585dc81baa6f36b0035dd6848ea43d318",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5c79ef616aa16af582fb2cb93b0f750975a0004f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5ce9b2bc9e73213e316a8c72400256a76bf41814",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/87840d4a3a21b1c19b867a80e16ba69dff284de2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c4e4fe330294e3936e0f4e15d6996468f8a45fb2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d7fa45d8123a7f794b93fc22dbcf19f38dc4d8cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}