CVE-2026-90343 (GCVE-0-2026-90343)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
wifi: cfg80211: stop PMSR before P2P and NAN teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wireless_dev is still present in the driver. cfg80211_leave_locked() and cfg80211_stop_pd() already do this before invoking the driver's stop callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not. Those helpers are also called directly by nl80211, rfkill shutdown, and wireless_dev unregister paths. If one of these paths stops a P2P device or NAN interface with a pending request, it removes the mac80211 subinterface from the driver first. Subsequent request cleanup cannot reach the lower driver's abort callback, but cfg80211 frees the request regardless. Driver state can then retain a stale request and use it when it later reports a result. Call cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN interface. This keeps lower-driver request state and cfg80211 request ownership in sync for all of the helpers' callers.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 , < 7a22cbc6c6bdd3c3811b4ce13875685c520f94de (git)
Affected: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 , < db3439ad11ac5e52decdefe784c98b21c3757848 (git)
Affected: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 , < 6c5fc504d0d6934132637aa3db4b9b58148eaa78 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a22cbc6c6bdd3c3811b4ce13875685c520f94de",
              "status": "affected",
              "version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
              "versionType": "git"
            },
            {
              "lessThan": "db3439ad11ac5e52decdefe784c98b21c3757848",
              "status": "affected",
              "version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
              "versionType": "git"
            },
            {
              "lessThan": "6c5fc504d0d6934132637aa3db4b9b58148eaa78",
              "status": "affected",
              "version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: stop PMSR before P2P and NAN teardown\n\nPMSR request teardown must abort active measurements while the\nwireless_dev is still present in the driver. cfg80211_leave_locked() and\ncfg80211_stop_pd() already do this before invoking the driver\u0027s stop\ncallback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not.\n\nThose helpers are also called directly by nl80211, rfkill shutdown, and\nwireless_dev unregister paths. If one of these paths stops a P2P device\nor NAN interface with a pending request, it removes the mac80211\nsubinterface from the driver first. Subsequent request cleanup cannot\nreach the lower driver\u0027s abort callback, but cfg80211 frees the request\nregardless. Driver state can then retain a stale request and use it when\nit later reports a result.\n\nCall cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN\ninterface. This keeps lower-driver request state and cfg80211 request\nownership in sync for all of the helpers\u0027 callers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is created when nl80211_stop_p2p_device() or nl80211_stop_nan() (also cfg80211_shutdown_all_interfaces() and _cfg80211_unregister_wdev()) call cfg80211_stop_p2p_device()/cfg80211_stop_nan() with a pending cfg80211_pmsr_request still on wdev-\u003epmsr_list; those paths are local generic-netlink/rfkill/unregister, not parsing of a received 802.11/FTM frame.\nAC:L - The attacker issues NL80211_CMD_PEER_MEASUREMENT_START (iwlwifi stores mvm-\u003eftm_initiator.req; hwsim stores data-\u003epmsr_request), then NL80211_CMD_STOP_P2P_DEVICE so drv_remove_interface() clears IEEE80211_SDATA_IN_DRIVER, then closes the socket so nl80211_netlink_notify()-\u003ecfg80211_release_pmsr() kfree()s the request while drv_abort_pmsr() returns without calling the driver.\nPR:L - NL80211_CMD_NEW_INTERFACE, NL80211_CMD_START_P2P_DEVICE, NL80211_CMD_PEER_MEASUREMENT_START and NL80211_CMD_STOP_P2P_DEVICE are GENL_UNS_ADMIN_PERM, checked as netlink_ns_capable(skb, net-\u003euser_ns, CAP_NET_ADMIN); an unprivileged user obtains that via unshare -Urn. (STOP_NAN is GENL_ADMIN_PERM, but the P2P path is sufficient.)\nUI:N - The attacker creates/starts the P2P_DEVICE wdev, starts the PMSR request, stops it via NL80211_CMD_STOP_P2P_DEVICE, and closes their own nl80211 socket; no other user must associate, mount, or confirm anything.\nS:U - The dangling cfg80211_pmsr_request is used in-process by iwl_mvm_ftm_range_resp()/iwl_mvm_ftm_restart() and cfg80211_pmsr_report() in the same kernel; this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After kfree(req) in cfg80211_pmsr_process_abort(), iwl_mvm_ftm_range_resp() and iwl_mvm_ftm_restart() still load mvm-\u003eftm_initiator.req-\u003ecookie, n_peers and peers[].addr and pass the object to cfg80211_pmsr_report(); that heap UAF is an arbitrary read primitive.\nI:H - The same stale ftm_initiator.req / hwsim pmsr_request is later passed to cfg80211_pmsr_complete() (list_del on the freed object) and used as live driver state, giving a heap write/control-flow hijack primitive from the UAF.\nA:H - iwl_mvm_ftm_range_resp() dereferences the freed cfg80211_pmsr_request when firmware later delivers a TOF range response (or iwl_mvm_ftm_restart() on FW restart), which oopses the kernel even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:45.339Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a22cbc6c6bdd3c3811b4ce13875685c520f94de"
        },
        {
          "url": "https://git.kernel.org/stable/c/db3439ad11ac5e52decdefe784c98b21c3757848"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c5fc504d0d6934132637aa3db4b9b58148eaa78"
        }
      ],
      "title": "wifi: cfg80211: stop PMSR before P2P and NAN teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90343",
    "datePublished": "2026-09-17T16:08:53.670Z",
    "dateReserved": "2026-09-11T19:38:34.804Z",
    "dateUpdated": "2026-09-18T17:54:45.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90343",
      "date": "2026-09-25",
      "epss": "0.00173",
      "percentile": "0.05955"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7a22cbc6c6bdd3c3811b4ce13875685c520f94de",
                    "status": "affected",
                    "version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db3439ad11ac5e52decdefe784c98b21c3757848",
                    "status": "affected",
                    "version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6c5fc504d0d6934132637aa3db4b9b58148eaa78",
                    "status": "affected",
                    "version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.0"
                  },
                  {
                    "lessThan": "5.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: stop PMSR before P2P and NAN teardown\n\nPMSR request teardown must abort active measurements while the\nwireless_dev is still present in the driver. cfg80211_leave_locked() and\ncfg80211_stop_pd() already do this before invoking the driver\u0027s stop\ncallback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not.\n\nThose helpers are also called directly by nl80211, rfkill shutdown, and\nwireless_dev unregister paths. If one of these paths stops a P2P device\nor NAN interface with a pending request, it removes the mac80211\nsubinterface from the driver first. Subsequent request cleanup cannot\nreach the lower driver\u0027s abort callback, but cfg80211 frees the request\nregardless. Driver state can then retain a stale request and use it when\nit later reports a result.\n\nCall cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN\ninterface. This keeps lower-driver request state and cfg80211 request\nownership in sync for all of the helpers\u0027 callers."
          }
        ],
        "id": "CVE-2026-90343",
        "lastModified": "2026-09-18T18:17:54.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:32.977",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6c5fc504d0d6934132637aa3db4b9b58148eaa78"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a22cbc6c6bdd3c3811b4ce13875685c520f94de"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db3439ad11ac5e52decdefe784c98b21c3757848"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.