CVE-2026-90343
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A flaw in Linux Wi-Fi handling can let a local user crash the system or gain elevated access when certain wireless features are stopped while measurements are still running.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in cfg80211 allows PMSR request state to become stale after P2P or NAN interface teardown removes the wireless_dev before the driver's abort callback is invoked, leaving the driver with a dangling request pointer that can be dereferenced on later result reporting.
Why it matters to the business
Linux systems using Wi-Fi P2P or NAN features may experience kernel instability, crashes, or potential local privilege escalation when active measurement requests are present during interface shutdown paths such as rfkill or nl80211 operations.
How an attack unfolds
A local attacker with access to a wireless device initiates a PMSR request, then triggers one of the unhandled teardown paths (cfg80211_stop_p2p_device, cfg80211_stop_nan, rfkill, or unregister) that removes the subinterface before aborting the measurement; the subsequent cleanup frees the request while the driver retains a reference, enabling use-after-free when the driver later reports results.
How to fix it
Update to a Linux kernel containing the fix that calls cfg80211_pmsr_wdev_down() before stopping P2P or NAN interfaces; rebuild and reboot affected systems.
How to confirm the fix worked
Confirm the patch is present by inspecting cfg80211 code for the cfg80211_pmsr_wdev_down() call in cfg80211_stop_p2p_device() and cfg80211_stop_nan(); test by starting PMSR then stopping the interface and verifying no stale state or crashes occur.
Typical attack path
- Obtain local access on a Linux system with cfg80211 and a driver supporting P2P/NAN and PMSR
- Start a P2P or NAN interface and issue an active PMSR request
- Trigger interface stop via nl80211, rfkill shutdown, or wireless_dev unregister
- Force the stale request to be acted upon by the driver to trigger memory corruption or crash
How to detect it
Inspect kernel logs for oops, warnings, or use-after-free reports originating from cfg80211 or mac80211 during P2P/NAN teardown; correlate with wireless interface state changes in audit or syslog around the same timestamp.
What your security team should do
- Prioritize kernel updates on all systems exposing Wi-Fi P2P or NAN interfaces
- Disable P2P and NAN features via configuration where not required until patched
- Monitor for kernel oops or wireless driver crashes correlated with interface teardown events
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wireless_dev is still present in the driver. cfg80211_leave_locked() and cfg80211_stop_pd() already do this before invoking the driver's stop callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not. Those helpers are also called directly by nl80211, rfkill shutdown, and wireless_dev unregister paths. If one of these paths stops a P2P device or NAN interface with a pending request, it removes the mac80211 subinterface from the driver first. Subsequent request cleanup cannot reach the lower driver's abort callback, but cfg80211 frees the request regardless. Driver state can then retain a stale request and use it when it later reports a result. Call cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN interface. This keeps lower-driver request state and cfg80211 request ownership in sync for all of the helpers' callers.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|