CVE-2026-46125wifi: mac80211: remove station if connection prep fails
Updated under an hour ago ()
Does this affect you?
It affects Linux and 7 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing station. Any "new_sta" is already being removed, so that doesn't need changes. This fixes a use-after-free/double-free in debugfs if that's enabled, because a vif going from MLD (and to MLD, but that's not relevant here) recreates its entire debugfs.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-825
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 81151ce462e533551f3284bfdb8e0f461c9220e6 builds before 18fed0a209500bfea5c4c08609ec93855e4e500b; from 81151ce462e533551f3284bfdb8e0f461c9220e6 before fe75fa1ac9a92990f7fc3d34b17808fd933071b2; from 81151ce462e533551f3284bfdb8e0f461c9220e6 before afcbaed89cdc1a001b43270cbf5394bb4804270a; 81151ce462e533551f3284bfdb8e0f461c9220e6 builds before 9e28654f79f443bca9b29ff3ae7cf18abfba58a0; 81151ce462e533551f3284bfdb8e0f461c9220e6 builds before 1c2b72ea89882aeb948340498391e69c58d466f1; 81151ce462e533551f3284bfdb8e0f461c9220e6 builds before 283fc9e44ff5b5ac967439b4951b80bd4299f4e4 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 0:6.12.0-211.26.1.el10_2 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:6.12.0-55.82.1.el10_0 not affected | CISA ADP |
from 0:4.18.0-477.147.1.el8_8 not affected | CISA ADP | |
from 0:4.18.0-477.147.1.el8_8 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:5.14.0-570.123.1.el9_6 not affected | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 6.0 before 6.1.176; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7; 7.1; 7.1 | NVD |
References
- https://git.kernel.org/stable/c/18fed0a209500bfea5c4c08609ec93855e4e500bpatch
- https://git.kernel.org/stable/c/fe75fa1ac9a92990f7fc3d34b17808fd933071b2patch
- https://git.kernel.org/stable/c/afcbaed89cdc1a001b43270cbf5394bb4804270apatch
- https://git.kernel.org/stable/c/9e28654f79f443bca9b29ff3ae7cf18abfba58a0patch
- https://git.kernel.org/stable/c/1c2b72ea89882aeb948340498391e69c58d466f1patch
- https://git.kernel.org/stable/c/283fc9e44ff5b5ac967439b4951b80bd4299f4e4patch
- https://access.redhat.com/errata/RHSA-2026:26427
- https://access.redhat.com/errata/RHSA-2026:26428
- https://access.redhat.com/errata/RHSA-2026:26462
- https://access.redhat.com/errata/RHSA-2026:26515
- https://access.redhat.com/errata/RHSA-2026:26563
- https://access.redhat.com/errata/RHSA-2026:27288
- https://access.redhat.com/errata/RHSA-2026:27708
- https://access.redhat.com/errata/RHSA-2026:27731
- https://access.redhat.com/errata/RHSA-2026:27735
- https://access.redhat.com/errata/RHSA-2026:27789
- https://access.redhat.com/security/cve/CVE-2026-46125
- https://bugzilla.redhat.com/show_bug.cgi?id=2482608
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46125.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.