8.8
/ 10
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
Basic Information
ID
CVE-2026-46152
Source
Linux
Published
May 28, 2026 at 09:36
Modified
May 30, 2026 at 10:48
Affected Product
Vendor
Linux
Product
Linux
Version
3468e1e0c639032a603450f0830ccabfa76f5806
Affected Versions
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 6.4
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 3468e1e0c639032a603450f0830ccabfa76f5806
Linux Linux 6.4
References
- git.kernel.org /stable/c/03584528bfffb195e384698af9148b94e42e3f14
- git.kernel.org /stable/c/1739fc31b4de06c5c78ce0741182770fb079091e
- git.kernel.org /stable/c/e131562d6f2b958148c35c98831b007f47f0e3d3
- git.kernel.org /stable/c/3ef44f96ccc3e06e059dec57842e366f0c4b1893
- git.kernel.org /stable/c/7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba