HIGH Introduced in 3.3
mac80211 IBSSDisconnect Race
CVE-2026-93804
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ibss: wait for in-flight TX on disconnect While leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be synchronize_net() in station flush and in this code later, packets can still be transmitted due to cross-CPU race conditions after carrier off is set. Therefore, it's possible for a race to happen where a TX to the driver occurs while or after telling it to leave the IBSS. This can be confusing to drivers, and in the case of iwlwifi leads to an attempt to use invalid queues. Move netif_carrier_off() to occur before sta_info_flush() during IBSS disconnect, and add synchronize_net() if flushing didn't, so that the synchronize_net() always happens between turning the carrier off and telling the driver, avoiding this race.
02KernelScan AI Analysis
Risk summary
A race condition in the mac80211 IBSS disconnect path allows in-flight packets to reach a WiFi driver after it has begun tearing down IBSS queues, resulting in use of invalid (freed) queue structures. This can crash the kernel or corrupt memory. Any device with WiFi hardware using IBSS (ad-hoc) mode is affected, and the disconnect can be triggered by a nearby WiFi peer in the same IBSS via channel switch announcement.
Vulnerability analysis
When a device leaves an ad-hoc WiFi network, the wireless subsystem turns off the network carrier, clears out peer stations, and tells the driver to leave the network. Because of timing differences between processors, a packet already in flight on another core can still be handed to the driver after teardown has begun. This causes the driver to access queue structures that are no longer valid, which can crash the kernel or corrupt memory. The fix moves the carrier shutdown to happen before clearing peer stations and adds a network synchronization barrier between disabling the carrier and notifying the driver, ensuring no in-flight transmission reaches the driver during teardown. The race can be triggered by a local administrator leaving the ad-hoc network, or by a nearby WiFi peer in the same network forcing a disconnect through a channel switch announcement.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 3.3 | 6.12.111 | 20a3fb5e1a95 |
| 6.18 | 3.3 | 6.18.53 | b3451e697124 |
| mainline | 3.3 | 7.2 | d0e69d9afa59 |
| cip/6.12 | 3.3 | 6.12.111-cip32 | 20a3fb5e1a95 |