Look up another CVE · open CVE-2026-90343 in the interactive tracker
CVE-2026-90343
wifi: cfg80211: stop PMSR before P2P and NAN teardown
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem net/wireless. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90343 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
PMSR request teardown must abort active measurements while the wireless_dev is still present in the driver. cfg80211_leave_locked() and cfg80211_stop_pd() already do this before invoking the driver's stop callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not. Those helpers are also called directly by nl80211, rfkill shutdown, and wireless_dev unregister paths. If one of these paths stops a P2P device or NAN interface with a pending request, it removes the mac80211 subinterface from the driver first. Subsequent request cleanup cannot reach the lower driver's abort callback, but cfg80211 frees the request regardless. Driver state can then retain a stale request and use it when it later reports a result. Call cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN interface. This keeps lower-driver request state and cfg80211 request ownership in sync for all of the helpers' callers.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/wireless/core.c
- What this is
- 802.11 (including CFG80211/NL80211)MAINTAINERS section matched on net/wireless/ · linux-wireless@vger.kernel.org · Maintained
- Kernel module
- cfg80211
Check it on the machine
grep -wE 'CONFIG_CFG80211|CONFIG_WIRELESS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cfg80211Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_CFG80211, CONFIG_WIRELESS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/wireless
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.0 | 6.18.52 | 7a22cbc6c6bd |
| 5.0 | 7.2.6 | db3439ad11ac |
| 5.0 | 7.3 | 6c5fc504d0d6 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is created when nl80211_stop_p2p_device() or nl80211_stop_nan() (also cfg80211_shutdown_all_interfaces() and _cfg80211_unregister_wdev()) call cfg80211_stop_p2p_device()/cfg80211_stop_nan() with a pending cfg80211_pmsr_request still on wdev->pmsr_list; those paths are local generic-netlink/rfkill/unregister, not parsing of a received 802.11/FTM frame.
- AC:LAttack complexity, low
- The attacker issues NL80211_CMD_PEER_MEASUREMENT_START (iwlwifi stores mvm->ftm_initiator.req; hwsim stores data->pmsr_request), then NL80211_CMD_STOP_P2P_DEVICE so drv_remove_interface() clears IEEE80211_SDATA_IN_DRIVER, then closes the socket so nl80211_netlink_notify()->cfg80211_release_pmsr() kfree()s the request while drv_abort_pmsr() returns without calling the driver.
- PR:LPrivileges required, low
- NL80211_CMD_NEW_INTERFACE, NL80211_CMD_START_P2P_DEVICE, NL80211_CMD_PEER_MEASUREMENT_START and NL80211_CMD_STOP_P2P_DEVICE are GENL_UNS_ADMIN_PERM, checked as netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN); an unprivileged user obtains that via unshare -Urn. (STOP_NAN is GENL_ADMIN_PERM, but the P2P path is sufficient.)
- UI:NUser interaction, none
- The attacker creates/starts the P2P_DEVICE wdev, starts the PMSR request, stops it via NL80211_CMD_STOP_P2P_DEVICE, and closes their own nl80211 socket; no other user must associate, mount, or confirm anything.
- S:UScope, unchanged
- The dangling cfg80211_pmsr_request is used in-process by iwl_mvm_ftm_range_resp()/iwl_mvm_ftm_restart() and cfg80211_pmsr_report() in the same kernel; this does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- After kfree(req) in cfg80211_pmsr_process_abort(), iwl_mvm_ftm_range_resp() and iwl_mvm_ftm_restart() still load mvm->ftm_initiator.req->cookie, n_peers and peers[].addr and pass the object to cfg80211_pmsr_report(); that heap UAF is an arbitrary read primitive.
- I:HIntegrity impact, high
- The same stale ftm_initiator.req / hwsim pmsr_request is later passed to cfg80211_pmsr_complete() (list_del on the freed object) and used as live driver state, giving a heap write/control-flow hijack primitive from the UAF.
- A:HAvailability impact, high
- iwl_mvm_ftm_range_resp() dereferences the freed cfg80211_pmsr_request when firmware later delivers a TOF range response (or iwl_mvm_ftm_restart() on FW restart), which oopses the kernel even without a full exploit.