CVE Vulnerability Catalog

In the Linux kernel wifi cfg80211 subsystem, a fix was made to not get the radio mask for netdev-less wdevs. cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and crashes in mac80211. The order of checks was inverted to avoid this.

In the Linux kernel, cfg80211_classify8021d() did not check the IP header size before reading the DS field. A frame that looks like IP but is too short caused a read of uninitialized memory (detected by KMSAN).

In the Linux kernel, dma_chan_put() unconditionally dropped the device reference while dma_chan_get() only took it on the slow path. This caused a kref underflow on every fast-path get/put pair.

In the Linux kernel, dma_chan_put() and dma_release_channel() contained a use-after-free. When dma_device_put() dropped the last reference, dma_device_release() could free the dma_device and its channels while dma_chan_put() still read chan->device->owner.

In the Linux kernel, dma_device_release() unlinked the device and freed it without an RCU grace period. Concurrent RCU readers in dma_issue_pending_all() could access the device after it was freed.

In the Linux kernel, cfg80211 freed a driver-owned scan request when an interface went down during a scan. The driver still believed it owned the request, leading to a use-after-free in scan_done().

In the Linux kernel, __cfg80211_bss_update() grouped hidden BSS entries with entries from probe responses lacking beacon elements. A later beacon with a hidden SSID triggered WARN_ON_ONCE in cfg80211_combine_bsses().

In the Linux kernel, cfg80211_update_assoc_bss_entry() filtered entries by BSS type when removing stale entries. An entry with a different capability bit (e.g. IBSS) remained, causing WARN_ON(!cmp) in cfg80211_rehash_bss().

In the Linux kernel, when joining an IBSS only the BSSID/channel was recorded in the event and the BSS entry was looked up during processing. This was racy (e.g. a new scan with NL80211_SCAN_FLAG_FLUSH could remove it), causing a warning in __cfg80211_ibss_joined().

In the Linux kernel, mac80211 could start a ROC (remain-on-channel) while a scan was in progress. This led to a warning in ieee80211_start_next_roc() during scan completion.

In the Linux kernel, mac80211 tried to offload TC setup on AP_VLAN interfaces, which are purely virtual. Since the AP interface may not always be known and could change, offload should not be performed.

In the Linux kernel's mac80211 subsystem, leaving a mesh network does not abort an ongoing channel switch (CSA), leading to a crash due to invalid memory access. The issue occurs when the channel context is released while the CSA finalize work is still running.

In the Linux kernel's mac80211 subsystem, when starting an access point (AP) fails, the interface state is not reset, leading to divide errors and warnings during scanning. The issue involves leaving beaconing enabled after a failed AP start.

In the Linux kernel's mac80211 subsystem, when bringing up an interface fails, the LED state is not reset, causing a timer to remain active and potentially be freed, leading to warnings and possible crashes. The issue involves the TPT trigger timer.

In the Linux kernel's mac80211 subsystem, the ieee80211_tdls_oper() function can operate on the AP station, leading to warnings when the AP station is removed or later confused for a TDLS peer. There is no check that the station is actually a TDLS peer.

In the Linux kernel's mac80211 subsystem, interfaces are not removed from the local->interfaces list when their netdev is unregistered without going through ieee80211_if_remove(). This can lead to a BUG in wiphy_to_rdev() during interface removal.

In the Linux kernel's cfg80211 subsystem, when a network namespace is destroyed, moving the wiphy to the initial namespace can fail, leaving a garbage netns pointer. This leads to a kernel fault when notifying about the wiphy.

In the Linux kernel's mac80211 subsystem, frames injected on a monitor interface can carry a radiotap field requesting a bandwidth wider than the actual channel bandwidth, leading to a warning in hwsim. Such frames should be dropped.

In the Linux kernel's mac80211 subsystem, the scan elements length (scan_ies_len) does not account for the HE 6 GHz Band Capability element, which can lead to failure in building probe requests and trigger a WARN_ON during scanning.

In the Linux kernel's mac80211 subsystem for mesh networks, the CSA state (ifmsh->csa) is not reset when leaving the mesh, leading to memory leaks and incorrect state (csa_role, chsw_ttl). The fix resets the state when leaving the mesh.