Cloudanix VulnDB

CVE-2026-93149

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in wireless testing code inside the operating system could cause crashes under rare conditions.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in mac80211_hwsim_stop() where skb_queue_empty() check followed by separate skb_dequeue() can return NULL when a concurrent TX status handler empties the queue under lock, causing NULL skb passed to ieee80211_free_txskb().

Why it matters to the business

Low-likelihood kernel instability or crashes limited to wireless simulation/testing environments; minimal operational disruption given low exploitability and niche usage.

How an attack unfolds

An attacker loads the mac80211_hwsim module, initiates a stop operation on the pending queue, and races with TX status completions to trigger the NULL skb dereference path leading to potential denial of service.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the empty-check-plus-dequeue loop with skb_dequeue() as the loop condition.

How to confirm the fix worked

Inspect mac80211_hwsim.c source for the stop function loop using skb_dequeue() directly as the condition; verify no separate skb_queue_empty() + skb_dequeue() pattern remains.

Typical attack path

  1. Load mac80211_hwsim kernel module
  2. Trigger queue population with pending frames
  3. Initiate mac80211_hwsim_stop() while racing TX status handlers
  4. Force skb_dequeue() to return NULL after empty check
  5. Observe NULL passed to ieee80211_free_txskb()

How to detect it

Review kernel logs and dmesg for oops or warnings referencing mac80211_hwsim_stop, skb_dequeue returning NULL, or ieee80211_free_txskb with invalid skb during module unload or interface stop.

  • mac80211_hwsim_stop
  • ieee80211_free_txskb.*NULL
  • skb_queue_empty.*dequeue race

What your security team should do

  • Apply available kernel updates containing the hwsim race fix
  • Disable or avoid mac80211_hwsim module in production systems
  • Monitor kernel logs for NULL pointer dereference oops involving ieee80211_free_txskb

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.

Affected packages

Ecosystem Package Introduced Fixed