Executive brief
A vulnerability exists in the Linux kernel's wireless networking subsystem (mac80211). It occurs when the system fails to properly verify if a network station supports direct link setup (TDLS) before performing certain operations. This can lead to unintended side effects that disrupt wireless connectivity or system stability, potentially allowing a local user to cause a denial of service or unauthorized configuration changes.
Technical details
A vulnerability in the Linux kernel's mac80211 wireless stack stems from a missing check in the ieee80211_tdls_oper function. When the NL80211_TDLS_ENABLE_LINK command is issued, the code verifies the existence of the station but fails to confirm if it is a valid Tunneled Direct Link Setup (TDLS) station. This allows the operation to proceed for non-TDLS peers, leading to side effects such as the modification of channel contexts and High Throughput (HT) protection settings before the operation eventually fails. A local attacker with basic privileges can exploit this to disrupt wireless networking or trigger inconsistent kernel states. Patches have been released across multiple stable kernel branches to ensure the sta->sta.tdls flag is checked early in the process.
Affected products
- Linux Linux Kernel versions from 3.2 up to 6.12.81, 6.13 up to 6.18.22, 6.19 up to 6.19.12, and 7.0-rc1 through 7.0-rc4
Timeline
- 2026-05-01: disclosed
- 2026-05-01: advisory: NVD published date
- 2026-03-13: patched: Initial patch commit date
References
- https://git.kernel.org/stable/c/44839ea7e96b3659a1606f3d5267063135479b7c
- https://git.kernel.org/stable/c/6813a8b1b240756dad4375f3e020ce10e4e3871b
- https://git.kernel.org/stable/c/7d73872d949c488a1d7c308031d6a9d89b5e0a8b
- https://git.kernel.org/stable/c/8148c2fda4ebb17104a573649c9b699208ad10ee
- https://git.kernel.org/stable/c/ba5b43db126a5e7378553869e3f7954d9187349f
- https://git.kernel.org/stable/c/be81f17151fcb8546a95f35ca8f4231b065985de
- https://git.kernel.org/stable/c/e77b2937aaa20264e4bd699d3244bdb50e7e3343