CVE-2026-93149

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

mac80211_hwsim_stop() drops any frames left in data->pending. The loop

currently checks skb_queue_empty() and then dequeues separately.

That split is racy with TX status handling, which can remove a pending

frame under the queue lock. If the last entry is removed after the empty

check, skb_dequeue() returns NULL and the stop path passes that NULL skb

to ieee80211_free_txskb().

Use skb_dequeue() as the loop condition instead. The dequeue result is the

object that stop owns and frees, and a concurrent status completion that

empties the queue simply makes the loop terminate.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References