CVE-2026-93149 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

Not scored Published 17 Sep 2026 Updated 19 Oct 2026

A race condition in the Linux kernel's mac80211_hwsim driver can cause a NULL pointer dereference, leading to a system crash.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-93149?

CVE-2026-93149 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

mac80211_hwsim_stop() drops any frames left in data->pending. The loop currently checks skb_queue_empty() and then dequeues separately.

That split is racy with TX status handling, which can remove a pending frame under the queue lock. If the last entry is removed after the empty check, skb_dequeue() returns NULL and the stop path passes that NULL skb to ieee80211_free_txskb().

Use skb_dequeue() as the loop condition instead. The dequeue result is the object that stop owns and frees, and a concurrent status completion that empties the queue simply makes the loop terminate.

Which versions are affected by CVE-2026-93149?

How do I fix CVE-2026-93149?

Apply the vendor's patch.

Is CVE-2026-93149 being exploited?

There is no known exploitation of CVE-2026-93149 in the wild and no public exploit code.

Sources

Also known as AZL-102957, BELL-CVE-2026-93149, DEBIAN-CVE-2026-93149, GHSA-9v89-8pp7-7fmp, UBUNTU-CVE-2026-93149.