GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-93149

Vulnerability from fkie_nvd - Published: 2026-09-17 17:18 - Updated: 2026-09-17 17:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d131027054a8dd922dda01fe8d381abe5af4970b",
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "versionType": "git"
            },
            {
              "lessThan": "c40ba47f2ba1951cb32ea048667ed014d36a5749",
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "versionType": "git"
            },
            {
              "lessThan": "2817431a61557f46dc63077b7cc126bc906c242e",
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "versionType": "git"
            },
            {
              "lessThan": "e7fccad2c8e6ef6bbafe509c95869d161d0f466b",
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "versionType": "git"
            },
            {
              "lessThan": "1c2a4ab6efa26415dd131b8c222e7893fda03435",
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "versionType": "git"
            },
            {
              "lessThan": "158438cd6ad69d6dd7d871582c38baf22169fede",
              "status": "affected",
              "version": "bd18de517923903a177508fc8813f44e717b1c00",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "78bf3c6131488b00386acd9aff1ea4e6c44fa38e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a9028333001f793b2724e8be42fce3336de2cf1c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7019c9f385b264a2d6f685028268422d55087e37",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.129",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.47",
              "versionType": "semver"
            },
            {
              "lessThan": "5.13",
              "status": "affected",
              "version": "5.12.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: avoid NULL skb in stop queue drain\n\nmac80211_hwsim_stop() drops any frames left in data-\u003epending. The loop\ncurrently checks skb_queue_empty() and then dequeues separately.\n\nThat split is racy with TX status handling, which can remove a pending\nframe under the queue lock. If the last entry is removed after the empty\ncheck, skb_dequeue() returns NULL and the stop path passes that NULL skb\nto ieee80211_free_txskb().\n\nUse skb_dequeue() as the loop condition instead. The dequeue result is the\nobject that stop owns and frees, and a concurrent status completion that\nempties the queue simply makes the loop terminate."
    }
  ],
  "id": "CVE-2026-93149",
  "lastModified": "2026-09-17T17:18:10.083",
  "metrics": {},
  "published": "2026-09-17T17:18:10.083",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.