CVE-2026-97492: wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: don't call ieee80211handlereconfigfailure when not needed

In case reconfiguration of NAN fails, we call ieee80211handlereconfigfailure, that marks all interfaces as not in the driver. Then, at the error path of the reconfig, cfg80211shutdownallinterfaces is called to destroy all the interfaces.

If we have any other interface but the NAN one, for example a BSS station, then when its state (links, stations) will be removed, we won't tell the driver about this, because we will think that the interfaces are not in the driver, and then drivers might remain with dangling pointers to objects like stations and links (at least for iwlwifi this is the case).

ieee80211handlereconfigfailure is meant to be called after we cleaned up the state in the driver, there is no reason to call it for NAN reconfiguration failure.

Fix the code to just warn in such a case, as we do in other error paths in reconfig where it is too complicated to rewind.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 24, 2026
CVE Published
via MITRE·04:04 PM
Data Sourced
via MITRE·04:04 PM
Description
Data Sourced
via NVD·05:17 PM
Description

Frequently Asked Questions

1

Which systems are most likely affected by this issue?

Systems using the Linux kernel's mac80211 Wi-Fi stack and NAN functionality are implicated. The problematic state can affect other active wireless interfaces, such as a BSS station interface, when NAN reconfiguration fails.

2

What condition triggers the problem?

The issue is triggered when NAN reconfiguration fails. During that failure path, the kernel can mark all interfaces as absent from the driver before interface cleanup occurs.

3

What is the practical impact on the Wi-Fi driver?

The driver may not be notified when links and stations are removed during interface shutdown. This can leave drivers with dangling pointers to objects such as stations and links; iwlwifi is specifically identified as an affected example.

4

What change resolves the faulty cleanup behavior?

The fix avoids calling ieee80211_handle_reconfig_failure for NAN reconfiguration failures and emits a warning instead. This prevents interfaces from being prematurely treated as no longer present in the driver during cleanup.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203