Executive brief
The Linux kernel's WiFi hardware simulator module (mac80211_hwsim) contains a race condition in its stop function that can trigger a NULL pointer dereference. When the WiFi simulator shuts down, it attempts to clean up pending network frames, but concurrent TX status handling can remove frames from the queue between the empty check and dequeue operation, causing the code to pass a NULL pointer to a memory cleanup function. This can cause a kernel crash or panic, disrupting services on systems using virtual WiFi simulation (primarily development and testing environments).
Technical details
The vulnerability is a race condition (CWE-362) in the mac80211_hwsim_stop() function in drivers/net/wireless/virtual/mac80211_hwsim_main.c. The original code checks if the pending frame queue is empty using skb_queue_empty(), then separately calls skb_dequeue() outside the lock. If TX status completion handlers remove the last frame between the check and dequeue, skb_dequeue() returns NULL, which is then passed to ieee80211_free_txskb(), causing a NULL pointer dereference. The fix changes the loop to use skb_dequeue() as the loop condition, eliminating the race by atomically checking and dequeuing in a single operation. No authentication or network access is required; the vulnerability is triggered during normal module shutdown on systems running affected kernel versions.
Affected products
- Linux Linux Kernel Multiple versions; see stable tree references (linux-4.x through linux-7.x series)
Timeline
- 2026-07-07: patched