CVE-2026-93149
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.
How to fix
- Linux Linuxd131027054a8dd922dda01fe8d381abe5af4970b, c40ba47f2ba1951cb32ea048667ed014d36a5749, 2817431a61557f46dc63077b7cc126bc906c242e, e7fccad2c8e6ef6bbafe509c95869d161d0f466b, 1c2a4ab6efa26415dd131b8c222e7893fda03435, 158438cd6ad69d6dd7d871582c38baf22169fede, 5.5, 5.11, 5.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | bd18de517923903a177508fc8813f44e717b1c00 ≤ v < d131027054a8dd922dda01fe8d381abe5af4970b, bd18de517923903a177508fc8813f44e717b1c00 ≤ v < c40ba47f2ba1951cb32ea048667ed014d36a5749, bd18de517923903a177508fc8813f44e717b1c00 ≤ v < 2817431a61557f46dc63077b7cc126bc906c242e, bd18de517923903a177508fc8813f44e717b1c00 ≤ v < e7fccad2c8e6ef6bbafe509c95869d161d0f466b, bd18de517923903a177508fc8813f44e717b1c00 ≤ v < 1c2a4ab6efa26415dd131b8c222e7893fda03435, bd18de517923903a177508fc8813f44e717b1c00 ≤ v < 158438cd6ad69d6dd7d871582c38baf22169fede, 78bf3c6131488b00386acd9aff1ea4e6c44fa38e, a9028333001f793b2724e8be42fce3336de2cf1c, 7019c9f385b264a2d6f685028268422d55087e37, 5.4.129 ≤ v < 5.5, 5.10.47 ≤ v < 5.11, 5.12.14 ≤ v < 5.13, 5.13 | d131027054a8dd922dda01fe8d381abe5af4970b, c40ba47f2ba1951cb32ea048667ed014d36a5749, 2817431a61557f46dc63077b7cc126bc906c242e, e7fccad2c8e6ef6bbafe509c95869d161d0f466b, 1c2a4ab6efa26415dd131b8c222e7893fda03435, 158438cd6ad69d6dd7d871582c38baf22169fede, 5.5, 5.11, 5.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.