---
id: CVE-2026-93149
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

  mac80211_hwsim_stop() drops any frames left in data->pending
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

  mac80211_hwsim_stop() drops any frames left in data->pending. The loop
  currently checks skb_queue_empty() and …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bd18de517923903a177508fc8813f44e717b1c00 <
    d131027054a8dd922dda01fe8d381abe5af4970b
  - >-
    Linux >= bd18de517923903a177508fc8813f44e717b1c00 <
    c40ba47f2ba1951cb32ea048667ed014d36a5749
  - >-
    Linux >= bd18de517923903a177508fc8813f44e717b1c00 <
    2817431a61557f46dc63077b7cc126bc906c242e
  - >-
    Linux >= bd18de517923903a177508fc8813f44e717b1c00 <
    e7fccad2c8e6ef6bbafe509c95869d161d0f466b
  - >-
    Linux >= bd18de517923903a177508fc8813f44e717b1c00 <
    1c2a4ab6efa26415dd131b8c222e7893fda03435
  - >-
    Linux >= bd18de517923903a177508fc8813f44e717b1c00 <
    158438cd6ad69d6dd7d871582c38baf22169fede
  - Linux 78bf3c6131488b00386acd9aff1ea4e6c44fa38e
  - Linux a9028333001f793b2724e8be42fce3336de2cf1c
  - Linux 7019c9f385b264a2d6f685028268422d55087e37
  - Linux >= 5.4.129 < 5.5
  - Linux >= 5.10.47 < 5.11
  - Linux >= 5.12.14 < 5.13
  - Linux 5.13
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:10.083'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93149'
references:
  - url: 'https://git.kernel.org/stable/c/158438cd6ad69d6dd7d871582c38baf22169fede'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1c2a4ab6efa26415dd131b8c222e7893fda03435'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2817431a61557f46dc63077b7cc126bc906c242e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c40ba47f2ba1951cb32ea048667ed014d36a5749'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d131027054a8dd922dda01fe8d381abe5af4970b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7fccad2c8e6ef6bbafe509c95869d161d0f466b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.741Z'
epss: 0.00205
epssPercentile: 0.10896
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

mac80211_hwsim_stop() drops any frames left in data->pending. The loop
currently checks skb_queue_empty() and then dequeues separately.

That split is racy with TX status handling, which can remove a pending
frame under the queue lock. If the last entry is removed after the empty
check, skb_dequeue() returns NULL and the stop path passes that NULL skb
to ieee80211_free_txskb().

Use skb_dequeue() as the loop condition instead. The dequeue result is the
object that stop owns and frees, and a concurrent status completion that
empties the queue simply makes the loop terminate.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.