In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: use safe list iteration in radar detect work

The call to ieee80211dfscaccancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: drop stray 'static' from fast-RX rxresult

ieee80211invokefastrx() is documented as safe for parallel RX, but its per-invocation rxresult is declared static. Concurrent callers then share one instance and can overwrite each other's result between ieee80211rxmeshdata() and the switch on res.

That can make a packet that was queued or consumed by ieee80211rxmeshdata() fall through into ieee80211rx8023(), or make a packet that should continue return as queued.

Make res an automatic variable so each invocation keeps its own result.

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: check tdls flag in ieee80211tdlsoper

When NL80211TDLSENABLELINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing.

Add a check for sta->sta.tdls early in the ENABLELINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers.