EUVD-2026-93324
GHSA-8rfq-q292-hgch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRogue AP within Wi-Fi range
-
DeliveryTarget client associates to AP
-
ExploitAP announces channel switch with colliding BSS type
-
ExecutionStale entry skipped, rehash hits WARN_ON
-
ImpactKernel BSS rbtree corruption/instability
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires an attacker-controlled rogue AP/Wi-Fi device within radio range (AV:A) and a target client that associates with it. The specific trigger is the associated AP switching to a channel that already has a BSS entry in the rbtree WHILE advertising a different/illegitimate BSS type bit (e.g. the IBSS capability bit), causing cfg80211_update_assoc_bss_entry() to skip the type-mismatched stale entry and the subsequent cfg80211_rehash_bss() to collide. Limiting factors: attacker must be adjacent on the wireless medium, the victim must be in an active association, and the malformed type change does not occur in normal operation - it must be deliberately induced by a rogue/non-compliant device. Impact is confined to the local system (S:U) and is primarily kernel instability (WARN_ON, with panic_on_warn amplifying it to a crash). |
| Impact | Multiple signals point to a LOW real-world priority despite the inflated CVSS base score. The input CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) claims full confidentiality, integrity and availability compromise, but this is inconsistent with the actual defect described: a BSS-type filtering error that lets a stale rbtree entry survive and trip a WARN_ON in cfg80211_rehash_bss(). That is a logic/consistency bug reachable only over Wi-Fi (AV:A, adjacent), and the realistic consequence is a kernel warning and potential rbtree corruption/instability - primarily an availability concern, not C:H/I:H. The claimed C:H and I:H impacts are NOT supported by the description and should be verified. EPSS reinforces low urgency: 0.18% probability at the 7th percentile. There is NO CISA KEV listing and NO public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Net: this is a high-CVSS-but-low-real-risk issue - a defensive hardening fix against a rogue AP edge case rather than an actively threatened vulnerability. The AV:A rating also limits exposure to attackers within Wi-Fi range of an associating client. |
| Exploit ScenarioDerived | An attacker operating a rogue access point within Wi-Fi range of a target device waits for the client to associate, then advertises a channel switch to a channel already holding a BSS entry while flipping the capability/type bits (e.g. setting the IBSS bit). When cfg80211 removes stale entries but skips the mismatched-type entry, the subsequent rehash collides and triggers WARN_ON, risking BSS rbtree corruption and kernel instability. No public exploit code is referenced, and the author notes the triggering type change 'shouldn't really happen' outside a deliberately malicious device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Kernel instability in the Linux wireless stack (cfg80211) lets an attacker-controlled rogue AP or Wi-Fi device within radio range drive a client into an assertion failure inside the BSS rbtree handling, resulting in a WARN_ON that becomes a full system crash when panic_on_warn is enabled. Only systems running the in-tree cfg80211/mac80211 code are affected, and exploitation requires an adjacent attacker plus a victim client actively associated to the malicious device; the malformed BSS type change does not occur in normal operation, so real-world exposure is limited to deliberate rogue-device scenarios. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.18% (7th percentile), and our independent assessment scores this 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the inflated 8.8 base score, reflecting availability-only impact with high attack complexity and adjacent access requirements.
RemediationAI
Vendor-released patch: Linux stable kernels 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4 contain the fix, which removes the BSS-type filter from the stale-entry lookup in cfg80211_update_assoc_bss_entry() - upgrade to the applicable branch version (or the distribution's backported kernel package) using the commits at https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc and the sibling stable links, and confirm the running kernel via uname -r. If immediate upgrade is not possible, the highest-value compensating control is disabling panic_on_warn (sysctl kernel.panic_on_warn=0) on affected hosts, which prevents a rogue-AP-induced WARN_ON from escalating to a reboot/crash but does not remove the assertion itself and will mask other kernel warnings, complicating future diagnostics. Reducing radio attack surface also helps: prevent clients from auto-associating with untrusted or unknown SSIDs (disable auto-join/hotspot roaming, pin known BSSIDs where the supplicant supports it, or disable the wireless interface on systems that do not need it), accepting the operational cost of lost mobility, and monitor dmesg for 'WARN_ON(!cmp)' or cfg80211_rehash_bss traces as a compromise indicator. Note that 5.4 has no patched version listed in the available data, so 5.4 users should track their distribution's backport status or plan migration to a supported longterm branch; there is no confirmation of active exploitation, so prioritize by exposure (wireless clients on untrusted radio environments) rather than by the 8.8 base score.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cfg80211 is the Linux kernel's 802.11 configuration layer that backs nl80211 and manages the scan/BSS database, where Basic Service Set (BSS) entries are indexed in an rbtree keyed by BSSID and related attributes. When an associated AP moves to a channel that already holds a BSS entry, cfg80211_update_assoc_bss_entry() must first delete the colliding entry before rehashing the real one; the bug is that this removal lookup also filtered on the connection's BSS type, so a stale entry advertising a different capability bit (for example the IBSS bit, which a rogue device can forge) survived the deletion. The immediately following cfg80211_rehash_bss() then encounters the leftover entry and trips WARN_ON(!cmp) because the rbtree comparison fails. Changing the BSS type on an existing entry is not a legitimate operational event, which is why the fix simply drops the type filter and removes any entry matching the comparison (git.kernel.org stable commits 6ef87a85, 1380ee3a, fb445ec7, 65fdb973, 64e23a36, 6d2fd261, 0aa44982, b377e100). Although no CWE is assigned in the source data, the defect class is closest to a reachable assertion (CWE-617) arising from an incomplete equality/validation check rather than a memory-safety fault, which is consistent with the availability-only (C:N/I:N/A:H) impact our assessment assigns; the 'Information Disclosure' tag on this record is not supported by the code path, and the supplied 8.8 base score (C:H/I:H/A:H) appears inflated relative to the assessed vector. The affected component is captured by CPE cpe:2.3:a:linux:linux, confirming this is an upstream kernel issue rather than a vendor-specific driver, and the CVSS vector carries PR:N, so no authentication is required - the barrier is physical/radio adjacency (AV:A) and deliberate malformation (AC:H).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent Wi-Fi vector (AV:A); AC:H because it requires a rogue AP to induce an abnormal channel-switch plus BSS-type change race; impact is kernel instability (A:H), with no supported confidentiality or integrity effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't filter by BSS type when removing stale entries
When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree.
The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it:
WARN_ON(!cmp)
Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.
Executive ViewAI
A kernel instability in the Linux wireless stack (cfg80211) can be triggered by an adjacent attacker to crash systems that have panic_on_warn enabled, potentially disrupting wireless connectivity. Exploitation requires a victim to associate with a malicious access point, and no public exploit identified at time of analysis. Organizations should prioritize patching for systems with high availability requirements, though the overall risk is moderate given the complex attack conditions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB