CVE-2026-46125: wifi: mac80211: remove station if connection prep fails
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: remove station if connection prep fails
If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing station. Any "newsta" is already being removed, so that doesn't need changes.
This fixes a use-after-free/double-free in debugfs if that's enabled, because a vif going from MLD (and to MLD, but that's not relevant here) recreates its entire debugfs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the Linux kernel's mac80211 Wi-Fi subsystem, specifically during failed connection preparation for MLO connections. The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1.
What conditions are needed to trigger the memory-management flaw?
A connection-preparation failure for an MLO connection must cause the interface to reset from MLD to non-MLD while an existing station associated with the removed vif link is retained. The described use-after-free/double-free occurs in debugfs when debugfs is enabled.
Is debugfs required for the described use-after-free or double-free?
Yes. The description states that the use-after-free/double-free is in debugfs and occurs if debugfs is enabled, because the vif transition recreates its debugfs state.