All vulnerabilities
CVE-2026-93804

Linux: wifi: mac80211: ibss: wait for in-flight TX on disconnect

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8e4a07ed82bae5d13525770880dc6dfd27f9bccdAlso 20a3fb5e1a95caa34896853ca17a50d21c754969CVE List
Published24 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 8e4a07ed82bae5d13525770880dc6dfd27f9bccdLinuxCVE List
  • 20a3fb5e1a95caa34896853ca17a50d21c754969LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: ibss: wait for in-flight TX on disconnect

While leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be synchronize_net() in station flush and in this code later, packets can still be transmitted due to cross-CPU race conditions after carrier off is set. Therefore, it's possible for a race to happen where a TX to the driver occurs while or after telling it to leave the IBSS. This can be confusing to drivers, and in the case of iwlwifi leads to an attempt to use invalid queues.

Move netif_carrier_off() to occur before sta_info_flush() during IBSS disconnect, and add synchronize_net() if flushing didn't, so that the synchronize_net() always happens between turning the carrier off and telling the driver, avoiding this race.

Text from CVE List

Affected versions 10

  • Linuxaffected: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd before 8e4a07ed82bae5d13525770880dc6dfd27f9bccdCVE List
  • Linuxaffected: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd before 20a3fb5e1a95caa34896853ca17a50d21c754969CVE List
  • Linuxaffected: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd before b3451e6971248250312ad32dd7f63cc9f0a925f5CVE List
  • Linuxaffected: 86a2ea4134b48f6371103cfceb521bf2d2bf76cd before d0e69d9afa59b93c30294eba89b1f15f69e91105CVE List
  • Linuxaffected: 3.3CVE List
  • Linuxunaffected: all versions before 3.3CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4