CVE-2026-90346 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: clean up color-change beacon data on errors
nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error.
Allocate the nested attribute table before parsing beacon_next. Its allocation failure can then return before beacon data exists, while a later parsing failure uses out: to release the parsed data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in the nl80211 subsystem represents a resource management flaw within the wireless networking stack, specifically affecting the handling of beacon data during color change operations. The function nl80211_color_change is responsible for processing configuration requests related to dynamic frequency selection and channel switching mechanisms used in modern Wi-Fi standards such as 802.11ax. During this process, the system invokes nl80211_parse_beacon to parse beacon template data provided by user-space applications or management frames. This parsing routine may allocate memory for nested attributes, specifically targeting parameters like mbssid_ies and rnr_ies which are critical for multi-SSID and reduced neighbor report functionalities. The core technical flaw lies in the error handling path of this function sequence. When a parsing failure occurs after these allocations have been initiated but before they are fully committed or integrated into stable data structures, the original code returned an error code directly without invoking the designated cleanup routine labeled out. This deviation from the standard control flow results in memory that was allocated during the partial parse operation remaining unreleased, creating a classic kernel memory leak scenario where resources are consumed by the process but never freed back to the system pool.
From a security and operational impact perspective, this vulnerability allows for the gradual degradation of system stability through resource exhaustion. Although individual leaks may involve relatively small amounts of memory associated with specific beacon templates, repeated triggering of this code path can lead to significant cumulative memory consumption within kernel space. In environments where wireless configuration changes are frequent or subjected to automated testing tools that intentionally trigger parsing errors, an attacker could exploit this behavior to induce a denial-of-service condition by exhausting available kernel memory. This aligns with the CWE-401 classification for missing release of memory after effective lifetime, highlighting a failure in proper resource deallocation logic. The impact is particularly relevant because nl80211 interfaces are often exposed to unprivileged users or network management daemons that might be compromised, thereby providing an attack vector for local privilege escalation via denial-of-service if the system becomes unstable enough to crash or trigger out-of-memory killers affecting critical services.
The remediation strategy implemented in this resolution focuses on restructuring the allocation and parsing sequence to ensure consistent error handling paths. By allocating the nested attribute table before attempting to parse beacon_next, the code ensures that any failure during the subsequent parsing phase can safely route through the standard cleanup mechanism labeled out. This structural change guarantees that all allocated resources are properly released regardless of whether the operation succeeds or fails due to malformed input data. The fix effectively closes the gap where intermediate allocations were left dangling upon error conditions. From a defensive engineering standpoint, this reinforces the principle of allocating resources early in the function scope so that they can be managed by a single exit point for cleanup, thereby eliminating race-like conditions between allocation and deallocation logic.
This vulnerability is categorized under CWE-401 which addresses improper release of memory or other system resources before their use ends. In terms of attack patterns, it relates to resource exhaustion techniques often seen in local denial-of-service attacks where an adversary repeatedly triggers error paths that fail to clean up state. The ATT&CK framework would classify this behavior under the T1496 category for Resource Hijacking, specifically focusing on CPU or memory consumption through inefficient handling rather than malicious code execution. Mitigation involves applying the kernel patch that corrects the control flow in nl80211_color_change to ensure all allocated beacon data is freed via the out label upon any parsing failure. System administrators should prioritize updating their Linux kernels to versions containing this fix, particularly those running wireless access point or client configurations where dynamic channel changes are actively utilized. Regular auditing of kernel logs for memory leak warnings can also help detect residual issues in older systems that have not yet been patched.