CVE-2026-93804 (GCVE-0-2026-93804)
Vulnerability from cvelistv5
Published
2026-09-24 16:02
Modified
2026-10-30 12:36
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ibss: wait for in-flight TX on disconnect While leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be synchronize_net() in station flush and in this code later, packets can still be transmitted due to cross-CPU race conditions after carrier off is set. Therefore, it's possible for a race to happen where a TX to the driver occurs while or after telling it to leave the IBSS. This can be confusing to drivers, and in the case of iwlwifi leads to an attempt to use invalid queues. Move netif_carrier_off() to occur before sta_info_flush() during IBSS disconnect, and add synchronize_net() if flushing didn't, so that the synchronize_net() always happens between turning the carrier off and telling the driver, avoiding this race.
References
Impacted products
Vendor Product Version
Linux Linux Version: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd
Version: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd
Version: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd
Version: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd
Version: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/ibss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "47185b5dbac264e7eb48c6d44368be6bfec17085",
              "status": "affected",
              "version": "86a2ea4134b48f6371103cfceb521bf2d2bf76cd",
              "versionType": "git"
            },
            {
              "lessThan": "8e4a07ed82bae5d13525770880dc6dfd27f9bccd",
              "status": "affected",
              "version": "86a2ea4134b48f6371103cfceb521bf2d2bf76cd",
              "versionType": "git"
            },
            {
              "lessThan": "20a3fb5e1a95caa34896853ca17a50d21c754969",
              "status": "affected",
              "version": "86a2ea4134b48f6371103cfceb521bf2d2bf76cd",
              "versionType": "git"
            },
            {
              "lessThan": "b3451e6971248250312ad32dd7f63cc9f0a925f5",
              "status": "affected",
              "version": "86a2ea4134b48f6371103cfceb521bf2d2bf76cd",
              "versionType": "git"
            },
            {
              "lessThan": "d0e69d9afa59b93c30294eba89b1f15f69e91105",
              "status": "affected",
              "version": "86a2ea4134b48f6371103cfceb521bf2d2bf76cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/ibss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: ibss: wait for in-flight TX on disconnect\n\nWhile leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes\nstations, turns the carrier off and immediately tells the driver to\nleave as well. While there may be synchronize_net() in station flush\nand in this code later, packets can still be transmitted due to\ncross-CPU race conditions after carrier off is set.\nTherefore, it\u0027s possible for a race to happen where a TX to the\ndriver occurs while or after telling it to leave the IBSS. This can\nbe confusing to drivers, and in the case of iwlwifi leads to an\nattempt to use invalid queues.\n\nMove netif_carrier_off() to occur before sta_info_flush() during\nIBSS disconnect, and add synchronize_net() if flushing didn\u0027t,\nso that the synchronize_net() always happens between turning the\ncarrier off and telling the driver, avoiding this race."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:36:48.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/47185b5dbac264e7eb48c6d44368be6bfec17085"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e4a07ed82bae5d13525770880dc6dfd27f9bccd"
        },
        {
          "url": "https://git.kernel.org/stable/c/20a3fb5e1a95caa34896853ca17a50d21c754969"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3451e6971248250312ad32dd7f63cc9f0a925f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0e69d9afa59b93c30294eba89b1f15f69e91105"
        }
      ],
      "title": "wifi: mac80211: ibss: wait for in-flight TX on disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93804",
    "datePublished": "2026-09-24T16:02:38.223Z",
    "dateReserved": "2026-09-18T17:59:28.790Z",
    "dateUpdated": "2026-10-30T12:36:48.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.