High · published May 28, 2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 6.4, < 6.6.140 | 6.6.140 |
| linux/linux_kernel | ≥ 6.7, < 6.12.88 | 6.12.88 |
| linux/linux_kernel | ≥ 6.13, < 6.18.30 | 6.18.30 |
| linux/linux_kernel | ≥ 6.19, < 7.0.7 | 7.0.7 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |