CVE-2026-97492 (GCVE-0-2026-97492)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-21 12:52
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed In case reconfiguration of NAN fails, we call ieee80211_handle_reconfig_failure, that marks all interfaces as not in the driver. Then, at the error path of the reconfig, cfg80211_shutdown_all_interfaces is called to destroy all the interfaces. If we have any other interface but the NAN one, for example a BSS station, then when its state (links, stations) will be removed, we won't tell the driver about this, because we will think that the interfaces are not in the driver, and then drivers might remain with dangling pointers to objects like stations and links (at least for iwlwifi this is the case). ieee80211_handle_reconfig_failure is meant to be called after we cleaned up the state in the driver, there is no reason to call it for NAN reconfiguration failure. Fix the code to just warn in such a case, as we do in other error paths in reconfig where it is too complicated to rewind.
References
Impacted products
Vendor Product Version
Linux Linux Version: 167e33f4f68cc8e4e3bdaf6d43641176c51f2d79
Version: 167e33f4f68cc8e4e3bdaf6d43641176c51f2d79
Version: 167e33f4f68cc8e4e3bdaf6d43641176c51f2d79
Version: 167e33f4f68cc8e4e3bdaf6d43641176c51f2d79
Version: 167e33f4f68cc8e4e3bdaf6d43641176c51f2d79
Version: 167e33f4f68cc8e4e3bdaf6d43641176c51f2d79
Version: 167e33f4f68cc8e4e3bdaf6d43641176c51f2d79
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "026637b864b16dfae238e7e1accded820a3d7ae8",
              "status": "affected",
              "version": "167e33f4f68cc8e4e3bdaf6d43641176c51f2d79",
              "versionType": "git"
            },
            {
              "lessThan": "6ef85dd9f8c62c9a465a32901d09475a114e67bd",
              "status": "affected",
              "version": "167e33f4f68cc8e4e3bdaf6d43641176c51f2d79",
              "versionType": "git"
            },
            {
              "lessThan": "f27a5bda84ff3b0fea3de7572ff48e518e66cf5d",
              "status": "affected",
              "version": "167e33f4f68cc8e4e3bdaf6d43641176c51f2d79",
              "versionType": "git"
            },
            {
              "lessThan": "d2ea99884793c0a8d940073c3dddbb887590718f",
              "status": "affected",
              "version": "167e33f4f68cc8e4e3bdaf6d43641176c51f2d79",
              "versionType": "git"
            },
            {
              "lessThan": "60b96e44489d6775fe9cd8df619c29e0dc285c49",
              "status": "affected",
              "version": "167e33f4f68cc8e4e3bdaf6d43641176c51f2d79",
              "versionType": "git"
            },
            {
              "lessThan": "6fb64029457cdcd77be546daf4c7c7cf04891857",
              "status": "affected",
              "version": "167e33f4f68cc8e4e3bdaf6d43641176c51f2d79",
              "versionType": "git"
            },
            {
              "lessThan": "7a8a3ff2815501f78f494808355ddf37e08647d0",
              "status": "affected",
              "version": "167e33f4f68cc8e4e3bdaf6d43641176c51f2d79",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t call ieee80211_handle_reconfig_failure when not needed\n\nIn case reconfiguration of NAN fails, we call\nieee80211_handle_reconfig_failure, that marks all interfaces as not in\nthe driver.\nThen, at the error path of the reconfig, cfg80211_shutdown_all_interfaces\nis called to destroy all the interfaces.\n\nIf we have any other interface but the NAN one, for example a BSS\nstation, then when its state (links, stations) will be removed, we\nwon\u0027t tell the driver about this, because we will think that the\ninterfaces are not in the driver, and then drivers might remain with\ndangling pointers to objects like stations and links (at least for\niwlwifi this is the case).\n\nieee80211_handle_reconfig_failure is meant to be called after we cleaned\nup the state in the driver, there is no reason to call it for NAN\nreconfiguration failure.\n\nFix the code to just warn in such a case, as we do in other error paths\nin reconfig where it is too complicated to rewind."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:52:52.958Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/026637b864b16dfae238e7e1accded820a3d7ae8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ef85dd9f8c62c9a465a32901d09475a114e67bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f27a5bda84ff3b0fea3de7572ff48e518e66cf5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2ea99884793c0a8d940073c3dddbb887590718f"
        },
        {
          "url": "https://git.kernel.org/stable/c/60b96e44489d6775fe9cd8df619c29e0dc285c49"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fb64029457cdcd77be546daf4c7c7cf04891857"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a8a3ff2815501f78f494808355ddf37e08647d0"
        }
      ],
      "title": "wifi: mac80211: don\u0027t call ieee80211_handle_reconfig_failure when not needed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97492",
    "datePublished": "2026-09-24T16:04:40.294Z",
    "dateReserved": "2026-09-24T16:01:01.150Z",
    "dateUpdated": "2026-10-21T12:52:52.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.