CVE-2026-90343 wifi: cfg80211: stop PMSR before P2P and NAN teardown
A use-after-free vulnerability in the Linux kernel Wi-Fi subsystem allows attackers to cause denial of service or execute code via improper PMSR teardown.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90343?
CVE-2026-90343 is a high-severity use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: stop PMSR before P2P and NAN teardown
PMSR request teardown must abort active measurements while the wireless_dev is still present in the driver. cfg80211_leave_locked() and cfg80211_stop_pd() already do this before invoking the driver's stop callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not.
Those helpers are also called directly by nl80211, rfkill shutdown, and wireless_dev unregister paths. If one of these paths stops a P2P device or NAN interface with a pending request, it removes the mac80211 subinterface from the driver first. Subsequent request cleanup cannot reach the lower driver's abort callback, but cfg80211 frees the request regardless. Driver state can then retain a stale request and use it when it later reports a result.
Call cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN interface. This keeps lower-driver request state and cfg80211 request ownership in sync for all of the helpers' callers.
Which versions are affected by CVE-2026-90343?
How do I fix CVE-2026-90343?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90343 being exploited?
There is no known exploitation of CVE-2026-90343 in the wild and no public exploit code.
Sources
Also known as AZL-102519, BELL-CVE-2026-90343, DEBIAN-CVE-2026-90343, GHSA-vfv4-5w5q-jr9p, UBUNTU-CVE-2026-90343.