« Volver al listado

CVE-2026-93149

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately.

That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb().

Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93149",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "d131027054a8dd922dda01fe8d381abe5af4970b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "c40ba47f2ba1951cb32ea048667ed014d36a5749",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "2817431a61557f46dc63077b7cc126bc906c242e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "e7fccad2c8e6ef6bbafe509c95869d161d0f466b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "1c2a4ab6efa26415dd131b8c222e7893fda03435",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "lessThan": "158438cd6ad69d6dd7d871582c38baf22169fede",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "78bf3c6131488b00386acd9aff1ea4e6c44fa38e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a9028333001f793b2724e8be42fce3336de2cf1c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7019c9f385b264a2d6f685028268422d55087e37",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.4.129",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.10.47",
              "lessThan": "5.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.12.14",
              "lessThan": "5.13",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.13",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:18:10.083",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: avoid NULL skb in stop queue drain\n\nmac80211_hwsim_stop() drops any frames left in data->pending. The loop\ncurrently checks skb_queue_empty() and then dequeues separately.\n\nThat split is racy with TX status handling, which can remove a pending\nframe under the queue lock. If the last entry is removed after the empty\ncheck, skb_dequeue() returns NULL and the stop path passes that NULL skb\nto ieee80211_free_txskb().\n\nUse skb_dequeue() as the loop condition instead. The dequeue result is the\nobject that stop owns and frees, and a concurrent status completion that\nempties the queue simply makes the loop terminate."
    }
  ],
  "lastModified": "2026-09-17T17:18:10.083",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}