{"id":"CVE-2026-93149","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: avoid NULL skb in stop queue drain\n\nmac80211_hwsim_stop() drops any frames left in data->pending","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: avoid NULL skb in stop queue drain\n\nmac80211_hwsim_stop() drops any frames left in data->pending. The loop\ncurrently checks skb_queue_empty() and …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= bd18de517923903a177508fc8813f44e717b1c00 < d131027054a8dd922dda01fe8d381abe5af4970b","Linux >= bd18de517923903a177508fc8813f44e717b1c00 < c40ba47f2ba1951cb32ea048667ed014d36a5749","Linux >= bd18de517923903a177508fc8813f44e717b1c00 < 2817431a61557f46dc63077b7cc126bc906c242e","Linux >= bd18de517923903a177508fc8813f44e717b1c00 < e7fccad2c8e6ef6bbafe509c95869d161d0f466b","Linux >= bd18de517923903a177508fc8813f44e717b1c00 < 1c2a4ab6efa26415dd131b8c222e7893fda03435","Linux >= bd18de517923903a177508fc8813f44e717b1c00 < 158438cd6ad69d6dd7d871582c38baf22169fede","Linux 78bf3c6131488b00386acd9aff1ea4e6c44fa38e","Linux a9028333001f793b2724e8be42fce3336de2cf1c","Linux 7019c9f385b264a2d6f685028268422d55087e37","Linux >= 5.4.129 < 5.5","Linux >= 5.10.47 < 5.11","Linux >= 5.12.14 < 5.13","Linux 5.13"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:18:10.083","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93149","references":[{"url":"https://git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.741Z","epss":0.00205,"epssPercentile":0.10896,"slug":"CVE-2026-93149","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: avoid NULL skb in stop queue drain\n\nmac80211_hwsim_stop() drops any frames left in data->pending. The loop\ncurrently checks skb_queue_empty() and then dequeues separately.\n\nThat split is racy with TX status handling, which can remove a pending\nframe under the queue lock. If the last entry is removed after the empty\ncheck, skb_dequeue() returns NULL and the stop path passes that NULL skb\nto ieee80211_free_txskb().\n\nUse skb_dequeue() as the loop condition instead. The dequeue result is the\nobject that stop owns and frees, and a concurrent status completion that\nempties the queue simply makes the loop terminate.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}