0.0
NA
CVE-2026-93149
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.

INFO

Published Date :

Sept. 17, 2026, 5:18 p.m.

Last Modified :

Sept. 17, 2026, 5:18 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-93149 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Update the Linux kernel to resolve a race condition in the mac80211_hwsim driver.
  • Update the Linux kernel.
  • Verify the mac80211_hwsim driver is correctly handled.
  • Ensure TX status handling is synchronized properly.
  • Review skb_dequeue usage in queue management.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-93149 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-93149 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-93149 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-93149 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Sep. 17, 2026

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: avoid NULL skb in stop queue drain mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately. That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb(). Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.
    Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/93xxx/CVE-2026-93149.json">CVE-2026-93149</a>
    Added Reference https://git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede
    Added Reference https://git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435
    Added Reference https://git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e
    Added Reference https://git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749
    Added Reference https://git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b
    Added Reference https://git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.