CVE-2026-46152: wifi: mac80211: drop stray 'static' from fast-RX rx_result
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rxresult
ieee80211invokefastrx() is documented as safe for parallel RX, but its per-invocation rxresult is declared static. Concurrent callers then share one instance and can overwrite each other's result between ieee80211rxmeshdata() and the switch on res.
That can make a packet that was queued or consumed by ieee80211rxmeshdata() fall through into ieee80211rx8023(), or make a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Update the mac80211 fast-RX code so the rx_result used by ieee80211_invoke_fast_rx() is an automatic (per-invocation) variable rather than static, preventing concurrent RX invocations from overwriting each other’s result and misreporting queued/consumed packets.
Linux kernel (mac80211 fast-RX) rx_result variable declaration (make per-invocation automatic) = automatic (non-static)
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The issue requires concurrent callers of ieee80211_invoke_fast_rx() in the mac80211 fast-RX path. A local attacker with low privileges is reflected in the supplied CVSS vector; no user interaction is required.
What is the practical impact of the race?
Concurrent receive processing can overwrite a shared rx_result value. This can cause a packet already queued or consumed by ieee80211_rx_mesh_data() to continue into ieee80211_rx_8023(), or cause a packet that should continue processing to be treated as queued, resulting in denial of service.
Which listed software is affected?
The provided data identifies the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1. The vulnerability is in the mac80211 Wi-Fi subsystem's fast-RX handling.
How is the issue fixed?
The fix changes rx_result from a static variable to an automatic per-invocation variable in ieee80211_invoke_fast_rx(). This prevents parallel receive handlers from sharing and overwriting the same result state.