CVE-2026-46166 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde
https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585
https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce
https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270

History

Thu, 28 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 28 May 2026 10:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.
Title		wifi: mac80211: use safe list iteration in radar detect work
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585 https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-28T09:36:21.675Z

Updated: 2026-05-28T09:36:21.675Z

Reserved: 2026-05-13T15:03:33.102Z

Link: CVE-2026-46166

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-28T10:16:32.250

Modified: 2026-05-28T13:44:01.663

Link: CVE-2026-46166

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-05-28T13:15:22Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46166", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.102Z", "datePublished": "2026-05-28T09:36:21.675Z", "dateUpdated": "2026-05-28T09:36:21.675Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-28T09:36:21.675Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use safe list iteration in radar detect work\n\nThe call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to\nbe freed and removed from the list. Guard against this to avoid a\nslab-use-after-free error."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/util.c"], "versions": [{"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c", "lessThan": "887ece6c23b49d02a6678e7a8d5ad213d75883ce", "status": "affected", "versionType": "git"}, {"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c", "lessThan": "7577a4b8a10fab45a6ee2045ea038a5adadbb585", "status": "affected", "versionType": "git"}, {"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c", "lessThan": "120149fb3ebcf674832ca3cafd32bedcdb686dde", "status": "affected", "versionType": "git"}, {"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c", "lessThan": "ac8eb3e18f41e2cc8492cc1d358bcb786c850270", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/util.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce"}, {"url": "https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585"}, {"url": "https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde"}, {"url": "https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270"}], "title": "wifi: mac80211: use safe list iteration in radar detect work", "x_generator": {"engine": "bippy-1.2.0"}}}}