Executive brief
A race condition was identified in the Linux kernel's Wi-Fi stack (mac80211) that could lead to incorrect network packet processing. In systems using Wi-Fi mesh networking, this flaw could cause data packets to be misrouted or dropped during high-speed reception. While primarily a stability and reliability issue, it could theoretically be used to disrupt wireless communications on affected devices.
Technical details
A race condition exists in the ieee80211_invoke_fast_rx() function within the mac80211 subsystem. The function was documented as thread-safe for parallel reception, but the 'rx_result' variable was incorrectly declared as 'static'. This causes concurrent callers to share a single memory instance, allowing one thread to overwrite the result of another between the execution of ieee80211_rx_mesh_data() and the subsequent switch statement. This logic error can cause mesh data packets to incorrectly fall through to standard 802.3 processing or return incorrect queue statuses. The fix involves changing the variable to an automatic (stack-based) variable to ensure thread isolation.
Affected products
- Linux Linux Kernel mac80211 component
Timeline
- 2026-04-24: other: Patch submitted by developer
- 2026-05-28: disclosed: CVE published
- 2026-05-28: patched: Fix integrated into various stable kernel branches
References
- https://git.kernel.org/stable/c/03584528bfffb195e384698af9148b94e42e3f14
- https://git.kernel.org/stable/c/1739fc31b4de06c5c78ce0741182770fb079091e
- https://git.kernel.org/stable/c/3ef44f96ccc3e06e059dec57842e366f0c4b1893
- https://git.kernel.org/stable/c/7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba
- https://git.kernel.org/stable/c/e131562d6f2b958148c35c98831b007f47f0e3d3