CVE-2026-97492 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
In case reconfiguration of NAN fails, we call ieee80211_handle_reconfig_failure, that marks all interfaces as not in the driver. Then, at the error path of the reconfig, cfg80211_shutdown_all_interfaces is called to destroy all the interfaces.
If we have any other interface but the NAN one, for example a BSS station, then when its state (links, stations) will be removed, we won't tell the driver about this, because we will think that the interfaces are not in the driver, and then drivers might remain with dangling pointers to objects like stations and links (at least for iwlwifi this is the case).
ieee80211_handle_reconfig_failure is meant to be called after we cleaned up the state in the driver, there is no reason to call it for NAN reconfiguration failure.
Fix the code to just warn in such a case, as we do in other error paths in reconfig where it is too complicated to rewind.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within the Linux kernel's mac80211 subsystem involves an improper handling of interface state during Network Anchor Node (NAN) reconfiguration failures. This issue stems from a logical flaw in the error path management when the wireless driver fails to apply requested configuration changes. Specifically, upon detecting a NAN reconfiguration failure, the code invokes ieee80211_handle_reconfig_failure. The intended purpose of this function is to mark all network interfaces as not being present in the underlying hardware driver, effectively signaling that no state needs to be cleaned up from the driver side because it was never successfully applied or has been rolled back at a lower level. However, this blanket marking creates a critical inconsistency when other active interface types, such as Basic Service Set (BSS) stations, are concurrently present and undergoing their own cleanup processes during the same reconfiguration event.
The operational impact of this flaw is significant for system stability and memory safety. When cfg80211_shutdown_all_interfaces is subsequently called to destroy all interfaces due to the overall failure, it iterates through each interface type to remove its state, including links and associated stations. For non-NAN interfaces like BSS stations, the cleanup logic checks whether the interface was previously marked as present in the driver before attempting to notify the driver of the removal. Because ieee80211_handle_reconfig_failure incorrectly flagged all interfaces as absent from the driver, the subsequent cleanup code for these other interfaces skips notifying the driver entirely. This omission means that while the kernel's internal data structures are cleared, the wireless driver retains references to objects such as station entries and link contexts that have been freed or invalidated in the host stack.
This discrepancy leads directly to dangling pointers within the driver subsystem. For drivers like iwlwifi, which maintain complex state machines for managing connected stations, these stale references can result in use-after-free conditions if the driver attempts to access or manipulate these objects later during normal operation or subsequent power management events. Such memory corruption vulnerabilities are particularly dangerous as they can lead to kernel panics, denial of service, or potentially arbitrary code execution depending on how the attacker might influence the state leading up to this failure scenario. The root cause is fundamentally a misapplication of error handling logic where a generic cleanup routine was applied too broadly without considering the specific lifecycle requirements of different interface types involved in the reconfiguration transaction.
From a classification perspective, this vulnerability aligns with CWE-416: Use After Free, as it results in references to memory objects that are no longer valid due to improper state tracking during error handling. It also relates to CWE-754: Improper Check for Unusual or Exceptional Conditions, specifically regarding the failure of reconfiguration operations not being handled with appropriate granularity for all interface types. In terms of MITRE ATT&CK mapping, this type of flaw could be leveraged in techniques associated with T1068: Exploitation for Privilege Escalation if an attacker can trigger the NAN reconfiguration failure under specific conditions to corrupt kernel memory and gain higher privileges.
To mitigate this vulnerability, developers must ensure that error handling paths distinguish between different interface types when determining whether driver-side cleanup is necessary. The fix involves removing the call to ieee80211_handle_reconfig_failure for NAN-specific failures where other interfaces remain active and require proper state synchronization with the driver. Instead of marking all interfaces as absent, the code should issue a warning log entry while allowing the standard shutdown procedures to proceed correctly for non-NAN interfaces. This ensures that drivers receive accurate notifications about which objects are being destroyed, preventing the accumulation of dangling pointers. System administrators should apply kernel updates that include this patch immediately to restore proper memory management integrity in wireless subsystems, particularly on systems utilizing iwlwifi or similar drivers with complex station management capabilities.