8.8
/ 10
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: remove station if connection prep fails
If connection preparation fails for MLO connections, then the
interface is completely reset to non-MLD. In this case, we must
not keep the station since it's related to the link of the vif
being removed. Delete an existing station. Any "new_sta" is
already being removed, so that doesn't need changes.
This fixes a use-after-free/double-free in debugfs if that's
enabled, because a vif going from MLD (and to MLD, but that's
not relevant here) recreates its entire debugfs.
wifi: mac80211: remove station if connection prep fails
If connection preparation fails for MLO connections, then the
interface is completely reset to non-MLD. In this case, we must
not keep the station since it's related to the link of the vif
being removed. Delete an existing station. Any "new_sta" is
already being removed, so that doesn't need changes.
This fixes a use-after-free/double-free in debugfs if that's
enabled, because a vif going from MLD (and to MLD, but that's
not relevant here) recreates its entire debugfs.
Basic Information
ID
CVE-2026-46125
Source
Linux
Published
May 28, 2026 at 09:35
Modified
May 30, 2026 at 10:48
Affected Product
Vendor
Linux
Product
Linux
Version
81151ce462e533551f3284bfdb8e0f461c9220e6
Affected Versions
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 6.0
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 81151ce462e533551f3284bfdb8e0f461c9220e6
Linux Linux 6.0
References
- git.kernel.org /stable/c/fe75fa1ac9a92990f7fc3d34b17808fd933071b2
- git.kernel.org /stable/c/afcbaed89cdc1a001b43270cbf5394bb4804270a
- git.kernel.org /stable/c/9e28654f79f443bca9b29ff3ae7cf18abfba58a0
- git.kernel.org /stable/c/1c2b72ea89882aeb948340498391e69c58d466f1
- git.kernel.org /stable/c/283fc9e44ff5b5ac967439b4951b80bd4299f4e4