wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.5, 5.11, 5.13, 6.1.188, 6.6.157, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From bd18de517923903a177508fc8813f44e717b1c00 · fixed in d131027054a8dd922dda01fe8d381abe5af4970b; From bd18de517923903a177508fc8813f44e717b1c00 · fixed in c40ba47f2ba1951cb32ea048667ed014d36a5749; From bd18de517923903a177508fc8813f44e717b1c00 · fixed in 2817431a61557f46dc63077b7cc126bc906c242e; From bd18de517923903a177508fc8813f44e717b1c00 · fixed in e7fccad2c8e6ef6bbafe509c95869d161d0f466b; From bd18de517923903a177508fc8813f44e717b1c00 · fixed in 1c2a4ab6efa26415dd131b8c222e7893fda03435; From bd18de517923903a177508fc8813f44e717b1c00 · fixed in 158438cd6ad69d6dd7d871582c38baf22169fede; From 5.4.129 · fixed in 5.5; From 5.10.47 · fixed in 5.11; From 5.12.14 · fixed in 5.13
- Linux Linux
5.13
- KernelLinux
From 5.13.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6