CVE-2026-98423 (GCVE-0-2026-98423)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping The code checks ->started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the WARN_ON(!local->started). Expand the mutex for this case and synchronise against it when the radio is stopped to avoid being able to hit the warning with hwsim. Drop the error print that would've complicated the error path, it only triggers for allocation failures (already noisy) and malformed frames anyway.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7882513bacb176ab4aacceefdd035ca9479da4fb
Version: 7882513bacb176ab4aacceefdd035ca9479da4fb
Version: 7882513bacb176ab4aacceefdd035ca9479da4fb
Version: 7882513bacb176ab4aacceefdd035ca9479da4fb
Version: 7882513bacb176ab4aacceefdd035ca9479da4fb
Version: 7882513bacb176ab4aacceefdd035ca9479da4fb
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ce9b2bc9e73213e316a8c72400256a76bf41814",
              "status": "affected",
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "versionType": "git"
            },
            {
              "lessThan": "c4e4fe330294e3936e0f4e15d6996468f8a45fb2",
              "status": "affected",
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "versionType": "git"
            },
            {
              "lessThan": "2f59be7585dc81baa6f36b0035dd6848ea43d318",
              "status": "affected",
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "versionType": "git"
            },
            {
              "lessThan": "5c79ef616aa16af582fb2cb93b0f750975a0004f",
              "status": "affected",
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "versionType": "git"
            },
            {
              "lessThan": "d7fa45d8123a7f794b93fc22dbcf19f38dc4d8cb",
              "status": "affected",
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "versionType": "git"
            },
            {
              "lessThan": "87840d4a3a21b1c19b867a80e16ba69dff284de2",
              "status": "affected",
              "version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: don\u0027t hand frames to mac80211 while stopping\n\nThe code checks -\u003estarted for frames coming from wmediumd, but the\nradio can be stopped after the check and before frame delivery,\ncausing mac80211 to hit the WARN_ON(!local-\u003estarted).\n\nExpand the mutex for this case and synchronise against it when the\nradio is stopped to avoid being able to hit the warning with hwsim.\n\nDrop the error print that would\u0027ve complicated the error path, it\nonly triggers for allocation failures (already noisy) and malformed\nframes anyway."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:19:16.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ce9b2bc9e73213e316a8c72400256a76bf41814"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4e4fe330294e3936e0f4e15d6996468f8a45fb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f59be7585dc81baa6f36b0035dd6848ea43d318"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c79ef616aa16af582fb2cb93b0f750975a0004f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7fa45d8123a7f794b93fc22dbcf19f38dc4d8cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/87840d4a3a21b1c19b867a80e16ba69dff284de2"
        }
      ],
      "title": "wifi: mac80211_hwsim: don\u0027t hand frames to mac80211 while stopping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98423",
    "datePublished": "2026-10-14T13:27:51.391Z",
    "dateReserved": "2026-09-25T10:25:14.348Z",
    "dateUpdated": "2026-10-19T09:19:16.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.