A vulnerability in the Linux kernel's mac80211 wireless subsystem could cause a warning due to improper handling of remain-on-channel (ROC) operations during scanning. Specifically, starting a ROC while a scan is in progress can lead to a race condition triggering a kernel warning.
A vulnerability in the Linux kernel's mac80211 wireless subsystem involves improper offloading of traffic control (TC) setup on AP_VLAN interfaces, which are purely virtual. The kernel incorrectly attempts to offload TC setup to drivers on these interfaces, which is not appropriate. The issue has been resolved by rejecting TC offload on AP_VLAN interfaces so that processing occurs in software instead.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem causes a crash due to improper handling of channel switch abort when leaving a mesh network. The issue arises because the channel switch announcement (CSA) remains active after leaving the mesh, but the channel context is released, leading to a null pointer dereference and kernel crash.
CVE-2026-98334 is a vulnerability in the Linux kernel's mac80211 WiFi subsystem where the state is not properly reset when starting an access point (AP) fails. This can cause the enable_beacon flag to remain set incorrectly, leading to kernel crashes (divide error) during scanning operations and warnings related to beaconing state confusion. The issue affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 6.8.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem causes the radio LED state and associated timer to not reset properly if bringing up the network interface fails. This can lead to a use-after-free condition related to the timer object. The issue affects specific Linux kernel versions and has been assigned CVE-2026-98333 with a high severity score.
A vulnerability in the Linux kernel's mac80211 wireless subsystem was fixed to ensure that the TDLS code only operates on TDLS peers. Previously, the function ieee80211_tdls_oper() could mistakenly operate on the AP station, causing warnings when the AP station was removed due to confusion with a TDLS peer.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allowed injection of frames with a requested bandwidth wider than the channel context. This could trigger warnings and potentially disrupt wireless operations. The issue has been resolved by dropping such frames entirely.
A vulnerability in the Linux kernel's mac80211 wireless subsystem related to handling HE 6 GHz capability in scan element lengths has been addressed. The issue involved missing size addition for the HE 6 GHz Band Capability element in probe requests, which could cause probe request element construction to fail and trigger kernel warnings during scanning.
A vulnerability in the Linux kernel's mac80211 mesh networking code causes a memory leak and state corruption when leaving a mesh network during a pending channel switch. The issue arises because the channel switch announcement (CSA) state is not reset properly, leading to leaked memory and mixed state variables. This flaw has been fixed by refactoring the reset logic and invoking it when stopping the mesh.
CVE-2026-98326 is a low-severity vulnerability in the Linux kernel's mac80211 wireless subsystem related to mesh networking. The issue occurs when ieee80211_start_mesh() fails after acquiring a channel context, but the channel context is not released properly. This can lead to errors during interface removal, causing warnings and potential instability in wireless interface handling.
A low severity vulnerability in the Linux kernel's mac80211 WiFi subsystem was fixed by initializing TX info earlier to properly handle failure paths. This fix ensures that failed transmission buffers are correctly reported to userspace, improving error handling and unifying failure paths in the code.
A vulnerability in the Linux kernel's netfilter nft_nat component causes uninitialized memory to be used in IPv4 address mapping. Specifically, the new_addr union is not fully initialized before being copied, leading to uninitialized bytes reaching nf_nat_setup_info(). This issue does not affect the IPv6 path. The vulnerability has been resolved by zero-initializing new_addr.
A memory leak vulnerability was identified and resolved in the Linux kernel's netfilter NAT subsystem. The issue occurred when nf_hook_entries_insert_raw() failed, causing NAT hooks not to be released properly. This flaw could lead to resource exhaustion due to unreleased hooks. The fix involved postponing the setting of nat_proto_net->nat_hook_ops until after successful hook registration to simplify error handling and ensure proper cleanup.
A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) subsystem caused a memory leak of drm_pending_vblank_event objects in certain error paths when out_fence_ptr is provided but DRM_MODE_PAGE_FLIP_EVENT is not set. This occurs due to failure to release allocated events during setup_out_fence() failures, potentially leading to resource leaks.
CVE-2026-98317 is a vulnerability in the Linux kernel's neighbor subsystem where the NDTPA_INTERVAL_PROBE_TIME_MS parameter lacks proper validation, allowing invalid values to bypass checks. This can cause the probe interval for NTF_MANAGED entries to be set incorrectly due to integer overflow and improper casting, potentially affecting timer behavior. The issue is mitigated by enforcing minimum and maximum limits on this parameter, with a maximum of one day to avoid disruption.
A vulnerability in the Linux kernel ALSA PCM timer initialization allows a NULL-pointer dereference due to the timer's private_data being unset when the timer is registered. This occurs because the timer is added to a global list before its private_data is assigned, enabling concurrent access that dereferences a NULL pointer.
A vulnerability in the Linux kernel ALSA 6fire driver allows an out-of-bounds (OOB) write due to improper handling of device-reported isochronous packet lengths. The flaw occurs when the actual_length reported by the device is less than 4, causing a wraparound in length calculation and leading to a buffer overflow in usb6fire_pcm_in_urb_handler(). This can cause kernel memory corruption and a kernel panic. The issue arises from insufficient validation of packet length before a memset operation on a fixed-size buffer.
A use-after-free (UAF) vulnerability exists in the Linux kernel's drm/vc4 driver due to improper handling of KMS polling during device unbind. The driver calls drm_kms_helper_poll_init() without a matching drm_kms_helper_poll_fini(), causing output poll work to run on a freed drm_device after unbind, leading to a kernel slab-use-after-free error. This issue has been fixed by using managed KMS polling to ensure polling is finalized with the device.
A vulnerability in the Linux kernel ALSA hda driver was fixed by moving a tracepoint to occur only after a stream is successfully assigned. This prevents accessing a NULL stream tag when hardware streams are exhausted.
A memory cleanup issue was identified and fixed in the Linux kernel's ath11k Wi-Fi driver. The vulnerability involved incomplete cleanup of arsta-related resources during station removal, which could lead to memory leaks. The fix refactors cleanup functions to ensure proper resource deallocation, addressing kmemleak reports.