CVE-2026-90346: wifi: nl80211: clean up color-change beacon data on errors
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: clean up color-change beacon data on errors
nl80211colorchange() calls nl80211parsebeacon() for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error.
Allocate the nested attribute table before parsing beaconnext. Its allocation failure can then return before beacon data exists, while a later parsing failure uses out: to release the parsed data.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In nl80211_color_change()/nl80211_parse_beacon() for the beacon_next template: allocate the nested attribute table before parsing beacon_next, and ensure that on later parsing failures the out: cleanup path releases any allocations made before the error (including params.beacon_next.mbssid_ies and .rnr_ies).
Linux kernel (nl80211) cleanup of color-change beacon data on parsing/allocation errors = Implement proper cleanup path (allocate nested attribute table before parsing beacon_next; ensure parsed beacon_next data is cleaned on errors rather than leaking allocations).
Event History
Frequently Asked Questions
What conditions are required to trigger the leak?
The error path is reached when parsing the beacon_next template in nl80211_color_change() fails after nl80211_parse_beacon() has already allocated MBSSID or RNR information-element data.
What is the impact of the vulnerable behavior?
Allocated beacon_next.mbssid_ies and beacon_next.rnr_ies data can be leaked when parsing fails, because the function returned without reaching its cleanup path.
How does the fix prevent the leak?
The nested attribute table is allocated before beacon_next parsing, so failure of that allocation occurs before beacon data exists. Later parsing failures are routed through the out cleanup path, which releases parsed beacon data.