The Linux kernel's wifi cfg80211 subsystem had a vulnerability where PMSR (Peer Measurement) request teardown did not properly abort active measurements before stopping P2P (Peer-to-Peer) and NAN (Neighbor Awareness Networking) interfaces. While some teardown functions like cfg80211_leave_locked() and cfg80211_stop_pd() correctly abort active requests before invoking the driver's stop callback, cfg80211_stop_p2p_device() and cfg80211_stop_nan() did not. These latter functions are called by nl80211, rfkill shutdown, and wireless device unregister paths. If these paths stop a P2P device or NAN interface with a pending PMSR request, the mac80211 subinterface is removed first, preventing the lower driver's abort callback from being reached. Consequently, cfg80211 frees the request, but the driver retains a stale request and may use it later when reporting results. The fix involves calling cfg80211_pmsr_wdev_down() before stopping the P2P or NAN interface to keep driver state and request ownership synchronized.

This vulnerability can lead to the Linux kernel wifi driver retaining stale PMSR requests, which may cause incorrect driver behavior. The CVSS score of 7.8 indicates high impact with potential confidentiality, integrity, and availability consequences. Specifically, stale requests could cause the driver to report incorrect measurement results or behave unpredictably, potentially affecting wireless communication reliability and security.

A fix for this vulnerability has been implemented in the Linux kernel by ensuring that cfg80211_pmsr_wdev_down() is called before stopping P2P or NAN interfaces. Users and administrators should apply the official Linux kernel updates that include this fix. Since no vendor advisory or patch links are provided here, check the Linux kernel mailing lists or official repositories for the relevant patch and update guidance. Patch status is not yet confirmed in this data — verify with vendor sources for current remediation.