CVE-2026-93804
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ibss: wait for in-flight TX on disconnect While leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be synchronize_net() in station flush and in this code later, packets can still be transmitted due to cross-CPU race conditions after carrier off is set. Therefore, it's possible for a race to happen where a TX to the driver occurs while or after telling it to leave the IBSS. This can be confusing to drivers, and in the case of iwlwifi leads to an attempt to use invalid queues. Move netif_carrier_off() to occur before sta_info_flush() during IBSS disconnect, and add synchronize_net() if flushing didn't, so that the synchronize_net() always happens between turning the carrier off and telling the driver, avoiding this race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93804
EUVD
EUVD-2026-86191

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the mac80211 subsystem when leaving an IBSS (Independent Basic Service Set) network. During disconnection, the system flushes stations, turns off the carrier, and instructs the driver to leave the network. However, due to cross-CPU race conditions, packets may still be transmitted after the carrier is turned off, leading to potential confusion for drivers like iwlwifi, which may attempt to use invalid queues.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and IBSS (Independent Basic Service Set) mode in WiFi. Detection requires checking the kernel version and configuration. Use uname -r to check the kernel version and grep CONFIG_MAC80211_IBSS /boot/config-$(uname -r) to verify IBSS support. If vulnerable, the kernel version will be before the fix.

Impact Analysis

This vulnerability could cause system instability or crashes in systems using affected Linux kernel versions, particularly when disconnecting from IBSS networks. It may lead to driver errors, data corruption, or unexpected behavior in wireless networking operations.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for this vulnerability. Check your distribution's security updates or compile a patched kernel. If immediate update is not possible, disable IBSS mode in WiFi settings to prevent exploitation until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart