CVE-2026-90346: wifi: nl80211: clean up color-change beacon data on errors
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: clean up color-change beacon data on errors
nl80211colorchange() calls nl80211parsebeacon() for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error.
Allocate the nested attribute table before parsing beaconnext. Its allocation failure can then return before beacon data exists, while a later parsing failure uses out: to release the parsed data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Operational
Ensure nl80211_color_change() routes parsing failures through the out: cleanup path so allocations completed while parsing the beacon_next template, including params.beacon_next.mbssid_ies and params.beacon_next.rnr_ies, are released.
- Operational
Allocate the nested attribute table before parsing beacon_next.
Event History
Frequently Asked Questions
What conditions are required to trigger the leak?
The error path is reached when parsing the beacon_next template in nl80211_color_change() fails after nl80211_parse_beacon() has already allocated MBSSID or RNR information-element data.
What is the impact of the vulnerable behavior?
Allocated beacon_next.mbssid_ies and beacon_next.rnr_ies data can be leaked when parsing fails, because the function returned without reaching its cleanup path.
How does the fix prevent the leak?
The nested attribute table is allocated before beacon_next parsing, so failure of that allocation occurs before beacon data exists. Later parsing failures are routed through the out cleanup path, which releases parsed beacon data.