Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: purge async notifications upon nic error

This fixes a kernel panic in reconfig failure:

1. we have a BSS connection
2. we have a NAN connection
3. FW error occurs
4. reconfig restores the BSS connection
5. however, restoring the NAN connection fails due to a FW error.
6. erroneously, ieee80211_handle_reconfig_failure is called and marks all
interfaces as not-in-driver (will be fixed in a different patch).
7. mac80211 frees the links of the BSS connection but doesn't tell the
driver about that, as it thinks that this vif is not in the driver.
8. in ieee80211_stop_device, *ALL* wiphy works are getting flushed
(erroneously?)
9. Therefore, async_handlers_wk is being executed, processing the
statistics notification that was received after we restored the BSS
connection.
10. the notification handler dereferences fw_id_to_bss_conf[id], which is
now a dangling pointer, as mac80211 already freed this link in (7).
11. On the first access to one of the links fields, we panic.

While this can and should be fixed by removing the call to
ieee80211_handle_reconfig_failure in (6), it is also not a good idea to
carry and maybe handle notifications from a dead FW.

We do purge the notifications when we stop the FW, but in reconfig
failure we stop the FW too late, after the notifications are processed.
In addition, async_handlers_wk can always be scheduled before the
reconfig work.

Purge the notifications immediately when transport notifies about a nic
error.
Published: 2026-09-24
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Panic / Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is in the iwlwifi wireless driver of the Linux kernel. When a firmware error occurs during a re‑configuration that restores a BSS connection but fails to restore a NAN connection, the code erroneously processes asynchronous notifications that reference a link that has already been freed. This use‑after‑free dereferences a dangling pointer and causes a kernel panic, effectively disabling the system. The weakness is CWE‑825, the improper release of a resource.

Affected Systems

The affected products are Linux distributions that include the Linux kernel with the iwlwifi driver for Intel wireless adapters. No specific kernel version range is provided; any kernel prior to the patch that contains the commit addressing this bug is vulnerable.

Risk and Exploitability

The bug carries a CVSS score of 7.4, indicating high severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker would need to trigger a firmware error during a re‑configuration, which might be achieved by sending crafted wireless traffic or using a malicious firmware image. However, this is inferred from the data and not explicitly stated.

Generated by OpenCVE AI on October 1, 2026 at 20:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a Linux kernel update that includes the iwlwifi reconfiguration failure fix.
  • If an update is not immediately available, disable the wireless interface or unload the iwlwifi driver to prevent the vulnerability from being reachable.
  • Keep the Intel wireless firmware up to date and obtain it from trusted sources, as firmware errors can contribute to triggering the bug.

Generated by OpenCVE AI on October 1, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 25 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 25 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 25 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 25 Sep 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5. however, restoring the NAN connection fails due to a FW error. 6. erroneously, ieee80211_handle_reconfig_failure is called and marks all interfaces as not-in-driver (will be fixed in a different patch). 7. mac80211 frees the links of the BSS connection but doesn't tell the driver about that, as it thinks that this vif is not in the driver. 8. in ieee80211_stop_device, *ALL* wiphy works are getting flushed (erroneously?) 9. Therefore, async_handlers_wk is being executed, processing the statistics notification that was received after we restored the BSS connection. 10. the notification handler dereferences fw_id_to_bss_conf[id], which is now a dangling pointer, as mac80211 already freed this link in (7). 11. On the first access to one of the links fields, we panic. While this can and should be fixed by removing the call to ieee80211_handle_reconfig_failure in (6), it is also not a good idea to carry and maybe handle notifications from a dead FW. We do purge the notifications when we stop the FW, but in reconfig failure we stop the FW too late, after the notifications are processed. In addition, async_handlers_wk can always be scheduled before the reconfig work. Purge the notifications immediately when transport notifies about a nic error.
Title wifi: iwlwifi: mld: purge async notifications upon nic error
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-28T05:30:02.441Z

Reserved: 2026-09-24T16:01:01.149Z

Link: CVE-2026-97474

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T17:17:24.547

Modified: 2026-09-28T06:16:33.277

Link: CVE-2026-97474

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-97474 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T20:30:04Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference