CVE-2026-93149: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211hwsim: avoid NULL skb in stop queue drain
mac80211hwsimstop() drops any frames left in data->pending. The loop currently checks skbqueueempty() and then dequeues separately.
That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skbdequeue() returns NULL and the stop path passes that NULL skb to ieee80211freetxskb().
Use skbdequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.
Event History
Frequently Asked Questions
When can this race be triggered?
It requires the mac80211_hwsim stop path to drain pending frames while TX status handling concurrently removes the last pending frame. The race occurs if that removal happens after the stop path checks that the queue is non-empty but before it dequeues the frame.
What is the immediate failure condition?
The stop path can receive a NULL result from skb_dequeue() and pass that NULL skb to ieee80211_free_txskb(). The resolved change makes the dequeue operation itself control the loop, so a concurrently emptied queue ends draining cleanly.
Which systems are relevant to triage?
Systems using the Linux kernel's mac80211_hwsim Wi-Fi hardware simulation component are relevant. The provided information does not identify affected kernel versions or whether the component is enabled by default.