Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed

In case reconfiguration of NAN fails, we call
ieee80211_handle_reconfig_failure, that marks all interfaces as not in
the driver.
Then, at the error path of the reconfig, cfg80211_shutdown_all_interfaces
is called to destroy all the interfaces.

If we have any other interface but the NAN one, for example a BSS
station, then when its state (links, stations) will be removed, we
won't tell the driver about this, because we will think that the
interfaces are not in the driver, and then drivers might remain with
dangling pointers to objects like stations and links (at least for
iwlwifi this is the case).

ieee80211_handle_reconfig_failure is meant to be called after we cleaned
up the state in the driver, there is no reason to call it for NAN
reconfiguration failure.

Fix the code to just warn in such a case, as we do in other error paths
in reconfig where it is too complicated to rewind.
Published: 2026-09-24
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

In the Linux kernel’s WLAN subsystem, a logic error causes the driver to call a failure‑handling routine when a NAN (Neighbor Awareness Networking) reconfiguration fails, marking all interfaces as detached from the driver. The error path then tears down every wireless interface. If other interfaces are present, their state is not reported back to the driver, leaving driver objects with invalid pointers, which can lead to a kernel crash and loss of Wi‑Fi service.

Affected Systems

All Linux kernels containing the mac80211 subsystem before the commit that removes the misplaced call are affected. The CNA listing provides only the generic Linux kernel product; no specific version range is supplied, so any distribution running an unpatched kernel is potentially vulnerable.

Risk and Exploitability

The likely attack vector is inferred to be local or privileged access to trigger a NAN reconfiguration failure, as the flaw is exercised only when that failure occurs. Once triggered, the improper error handling can corrupt driver data, culminating in a kernel crash and denial of service. The CVSS score is 5.5, the EPSS score is below 1%, and the vulnerability is not in the CISA KEV catalog, indicating low public exploitation probability but a clear impact on availability.

Generated by OpenCVE AI on October 1, 2026 at 16:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a Linux kernel update that removes the erroneous check and replaces it with a warning.
  • Reboot the system to load the updated kernel.
  • If an immediate kernel upgrade is not possible, temporarily disable NAN functionality to prevent reconfiguration failures.

Generated by OpenCVE AI on October 1, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4817-1 linux-6.12 security update
Debian DLA Debian DLA DLA-4841-1 linux security update
Debian DSA Debian DSA DSA-6528-1 linux security update
History

Wed, 21 Oct 2026 13:15:00 +0000


Sat, 03 Oct 2026 11:15:00 +0000


Thu, 01 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low


Fri, 25 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed In case reconfiguration of NAN fails, we call ieee80211_handle_reconfig_failure, that marks all interfaces as not in the driver. Then, at the error path of the reconfig, cfg80211_shutdown_all_interfaces is called to destroy all the interfaces. If we have any other interface but the NAN one, for example a BSS station, then when its state (links, stations) will be removed, we won't tell the driver about this, because we will think that the interfaces are not in the driver, and then drivers might remain with dangling pointers to objects like stations and links (at least for iwlwifi this is the case). ieee80211_handle_reconfig_failure is meant to be called after we cleaned up the state in the driver, there is no reason to call it for NAN reconfiguration failure. Fix the code to just warn in such a case, as we do in other error paths in reconfig where it is too complicated to rewind.
Title wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-21T12:52:52.958Z

Reserved: 2026-09-24T16:01:01.150Z

Link: CVE-2026-97492

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T17:17:26.833

Modified: 2026-10-21T13:21:10.713

Link: CVE-2026-97492

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-97492 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T16:15:10Z

Weaknesses
  • CWE-825

    Expired Pointer Dereference