A vulnerability in the Linux kernel's wifi cfg80211 subsystem related to improper teardown of PMSR requests before P2P and NAN interface shutdown has been resolved. The flaw could cause driver state to retain stale requests, potentially leading to incorrect handling of wireless measurements. The issue affects specific versions of the linux-hwe-edge kernel and has a CVSS score of 7.8, indicating a medium severity level.
A vulnerability in the Linux kernel's iwlwifi driver for Intel wireless devices was resolved by adding a check on the SAP message length before reading it. This prevents a buffer overflow by ensuring the message size does not exceed the local buffer. The flaw affects specific versions of the linux-hwe-edge kernel. The vulnerability has a CVSS score of 8.4, indicating a high severity impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. A fix has been implemented in the affected versions.
A buffer overread vulnerability was identified and resolved in the Linux kernel's ath11k wireless driver component. The flaw involved reading the firmware buffer without verifying that it contained enough data to hold a expected header, potentially leading to out-of-bounds memory access. The fix adds an upfront length check before dereferencing the buffer to prevent this condition. This issue affects specific Linux kernel versions used in various Ubuntu distributions.
A vulnerability in the Linux kernel's mt76 wireless driver for the mt7915 chipset causes improper cleanup when adding a network interface fails. Specifically, if mt76_wcid_alloc() fails, the function mt7915_add_interface() does not clear certain state bits or remove firmware device information, leading to resource leaks and potential stale pointer dereferences in testmode. This issue has been fixed in later commits.
A vulnerability in the Linux kernel's nl80211 wireless subsystem was fixed to address a memory leak issue during beacon data parsing errors. The flaw involved improper cleanup of allocated memory when parsing beacon templates failed, potentially causing resource leaks.
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses the out_free_eeprom_blob label. Consequently, error paths triggered after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob. Fix this memory leak by reordering the error handling labels so that out_free_eeprom falls through to out_free_eeprom_blob. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have supported Intel DVM wireless hardware and firmware to test with, no runtime testing was able to be performed.
CVE-2026-89524 is a vulnerability in the Linux kernel's ath6kl wireless driver where assoc request/response lengths are improperly clamped before subtracting fixed IE offsets. This causes an underflow in length calculations, leading to a large wrapped value that is used to copy data from kernel memory to user space, potentially disclosing adjacent slab memory. The flaw was found in versions including 3.11.0-12.19 through 3.13.0-8.28 and has a high severity score.
CVE-2026-89523 is a high-severity vulnerability in the Linux kernel's mt76 wireless driver for the mt7925 device. The flaw involves pending work (mlo_pm_work) that can run after the device is reset, suspended, or unregistered, potentially accessing freed memory or sending commands when firmware is unavailable. This issue has been resolved by ensuring the cancellation of the pending work in all relevant teardown and suspend paths.
A deadlock vulnerability in the Linux kernel's mt76 wireless driver for the mt7615 chipset was fixed. The issue occurred because the suspend function held a mutex while synchronously cancelling a delayed work item that also tried to acquire the same mutex, causing a deadlock. The fix involves flushing certain work items before taking the mutex to avoid this condition.
A vulnerability in the Linux kernel's mt76 wireless driver for the mt7996 device allows a malicious or malfunctioning device to cause an out-of-bounds write by reporting an arbitrary EEPROM address. This occurs because the destination offset for an EFUSE/EXT block copy is not properly bounded, potentially leading to memory corruption. The issue has been resolved by rejecting responses with addresses that would place the copy outside the valid EEPROM data area.
The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_standalone/hl78xx/) embeds a generic struct gnss_nmea0183_match_data match_data inside struct hl78xx_gnss_data. The generic NMEA0183 match helper (drivers/gnss/gnss_nmea0183_match.c) requires that context to be the first member because its callbacks cast user_data directly to struct gnss_nmea0183_match_data . In the affected releases match_data was the second member (after const struct device dev), so it sat at a non-zero offset while gnss_nmea0183_match_init() initialized it at the correct address. The registered NMEA handlers instead pass the whole device data object (data->devices.gnss->data, offset 0), producing an offset-shifted type confusion between where state is initialized and where the parse callbacks read and write it.
When NMEA sentences from the GNSS receiver are parsed, the GGA/RMC callbacks write parsed fix data into the wrong location within the struct, and the GSV callback (gnss_nmea0183_match_gsv_callback, active under CONFIG_GNSS_SATELLITES) reads its satellites pointer and bound from the wrong offsets — non-pointer bytes of struct hl78xx_gnss_data — and then writes parsed struct gnss_satellite entries through that bogus pointer. This is a write through an uninitialized/wild pointer with a garbage bound.
The NMEA handlers are registered by default (CONFIG_HL78XX_GNSS_SOURCE_NMEA is the default GNSS source) on devices using the HL78xx GNSS. The driver runs in kernel context and the NMEA data originates from the GNSS radio front-end, so a party able to influence the GNSS signal (for example GNSS/GPS spoofing at radio proximity) can drive the kernel-side parser into the faulty write. The most likely impact is a crash (denial of service) because the bogus pointer resolves to a fixed near-NULL value, with adjacent-memory corruption possible on MMU-less targets. Confidentiality is not affected. Exploitation requires the satellites feature to be enabled and active, so attack complexity is high.
An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality.
The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.
CVE-2026-69862 is an out-of-bounds read vulnerability in the Windows Wireless Wide Area Network Service affecting multiple versions of Microsoft Windows 10. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue in the affected Windows 10 versions.
CVE-2026-69517 is a use-after-free vulnerability in the Windows Wireless Networking component of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has been assigned a high severity rating with a CVSS score of 7.0. Microsoft has released official fixes for all affected versions.
This content is an Ask Me Anything (AMA) session hosted by Larry Pesce, a cybersecurity expert with over 20 years of experience in IoT, wireless hacking, and software supply chain security. The post is an invitation for the community to ask questions about various security topics, including hardware and firmware hacking, wireless security, supply chain security, and regulatory compliance. It does not describe a specific vulnerability, exploit, or active threat.
A vulnerability in the Linux kernel's mt7925 wireless driver can cause a kernel panic when forwarding frames through a bridged wired interface due to insufficient headroom in socket buffers. This occurs because the driver assumes extra headroom is reserved for TX descriptors and USB headers, which is not guaranteed for forwarded frames. The issue was identified on devices such as Raspberry Pi 5 and MT7986 routers running OpenWrt. The flaw was fixed by adding a guard to ensure adequate headroom, similar to a previous fix for mt7921.
DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a known value and connect to the drone's internal Wi-Fi network, potentially gaining access to the flight control interface and issuing flight commands. Crafted DUML commands can also disable or restart the Wi-Fi and Bluetooth interfaces, disconnect Wi-Fi clients, or reset wireless configuration, resulting in a denial-of-service condition that can disrupt the operator's wireless control, video, and telemetry connections during flight.
Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.
Remediation requires a firmware update from the vendor.
This entry describes a categorized index of security tools organized by phases such as reconnaissance, wireless, forensics, and reverse engineering. It is a curated collection of links to external tools maintained by original authors, intended to help security professionals avoid rebuilding bookmarks repeatedly. No software vulnerability or exploit is described.