---
id: CVE-2026-46166
title: 'wifi: mac80211: use safe list iteration in radar detect work'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: use safe list iteration in radar detect work

  The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to
  be freed and removed from the list.…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c <
    887ece6c23b49d02a6678e7a8d5ad213d75883ce
  - >-
    Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c <
    7577a4b8a10fab45a6ee2045ea038a5adadbb585
  - >-
    Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c <
    120149fb3ebcf674832ca3cafd32bedcdb686dde
  - >-
    Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c <
    ac8eb3e18f41e2cc8492cc1d358bcb786c850270
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:20:37.686934Z'
published: '2026-05-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:05.890Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46166'
references:
  - url: 'https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce'
  - url: 'https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585'
  - url: 'https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde'
  - url: 'https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270'
tags:
  - cve.org
epss: 0.00287
epssPercentile: 0.19819
ingestedAt: '2026-10-16T17:24:46.711Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: use safe list iteration in radar detect work

The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to
be freed and removed from the list. Guard against this to avoid a
slab-use-after-free error.

## Affected

- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 887ece6c23b49d02a6678e7a8d5ad213d75883ce`
- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 7577a4b8a10fab45a6ee2045ea038a5adadbb585`
- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < 120149fb3ebcf674832ca3cafd32bedcdb686dde`
- `Linux >= bca8bc0399ac2efd56e6adbed0307e10125a556c < ac8eb3e18f41e2cc8492cc1d358bcb786c850270`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.