SB20260924115 - Expired pointer dereference in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) Expired pointer dereference (CVE-ID: CVE-2026-97492)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave drivers with dangling pointers.

The vulnerability exists due to improper state cleanup in the mac80211 ieee80211_reconfig NAN reconfiguration failure handling when handling a failed NAN reconfiguration while other interfaces are present. A local user can trigger NAN reconfiguration processing that fails to leave drivers with dangling pointers.

The stale pointers can reference station and link objects.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/60b96e44489d6775fe9cd8df619c29e0dc285c49
• https://git.kernel.org/stable/c/6fb64029457cdcd77be546daf4c7c7cf04891857
• https://git.kernel.org/stable/c/7a8a3ff2815501f78f494808355ddf37e08647d0