Cloudanix VulnDB

CVE-2026-90346

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in the Linux wireless code can slowly leak memory when certain error conditions occur, potentially causing wireless networking to become unstable.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Improper error handling in nl80211_color_change allows nl80211_parse_beacon to allocate mbssid_ies and rnr_ies structures that are not released when a later parsing step fails, producing a kernel memory leak.

Why it matters to the business

Repeated triggering can exhaust kernel memory on wireless access points or clients, leading to degraded network performance or denial of service for wireless operations.

How an attack unfolds

An attacker supplies a malformed color-change beacon request that passes initial parsing but fails at a subsequent step; the direct return path bypasses the out: cleanup label, leaving the allocated beacon IES structures unreleased.

How to fix it

Apply the upstream kernel commit that moves nested attribute table allocation before beacon_next parsing so all error paths use the out: cleanup label; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the nl80211_color_change and nl80211_parse_beacon functions for the reordered allocation and unified error path; test by injecting a failing beacon parse and verifying no leak via kmemleak or slab accounting.

Typical attack path

  1. Obtain local or remote access capable of sending nl80211 color-change commands
  2. Craft a beacon_next template containing nested attributes that trigger a late parsing failure
  3. Invoke nl80211_color_change repeatedly to accumulate unreleased allocations
  4. Monitor for kernel memory pressure or OOM conditions affecting the wireless stack

How to detect it

Monitor kernel logs for repeated nl80211 parsing failures combined with rising slab memory usage in the wireless subsystem; inspect kmemleak reports for unreleased mbssid_ies or rnr_ies structures after color-change operations.

What your security team should do

  • Prioritize kernel updates on systems exposing nl80211 color-change functionality
  • Enable CONFIG_DEBUG_KMEMLEAK and monitor for unreleased nl80211 allocations
  • Restrict unprivileged access to nl80211 netlink commands via capability or LSM controls until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error. Allocate the nested attribute table before parsing beacon_next. Its allocation failure can then return before beacon data exists, while a later parsing failure uses out: to release the parsed data.

Affected packages

Ecosystem Package Introduced Fixed