{"id":"CVE-2026-46166","title":"wifi: mac80211: use safe list iteration in radar detect work","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use safe list iteration in radar detect work\n\nThe call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to\nbe freed and removed from the list.…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 887ece6c23b49d02a6678e7a8d5ad213d75883ce","Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 7577a4b8a10fab45a6ee2045ea038a5adadbb585","Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 120149fb3ebcf674832ca3cafd32bedcdb686dde","Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < ac8eb3e18f41e2cc8492cc1d358bcb786c850270","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:20:37.686934Z"},"published":"2026-05-28","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:31:05.890Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46166","references":[{"url":"https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce"},{"url":"https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585"},{"url":"https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde"},{"url":"https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270"}],"tags":["cve.org"],"epss":0.00287,"epssPercentile":0.19819,"ingestedAt":"2026-10-16T17:24:46.711Z","slug":"CVE-2026-46166","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use safe list iteration in radar detect work\n\nThe call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to\nbe freed and removed from the list. Guard against this to avoid a\nslab-use-after-free error.\n\n## Affected\n\n- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 887ece6c23b49d02a6678e7a8d5ad213d75883ce`\n- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 7577a4b8a10fab45a6ee2045ea038a5adadbb585`\n- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 120149fb3ebcf674832ca3cafd32bedcdb686dde`\n- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < ac8eb3e18f41e2cc8492cc1d358bcb786c850270`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}