CVE-2026-80616

A flaw was found in the Linux kernel's ieee802154 component. An unnecessary warning message (WARN_ON) can be triggered when memory allocation fails in the cfg802154_switch_netns() function. This can lead to diagnostic messages being logged due to deliberate fault injections, but does not pose a direct security risk such as arbitrary code execution or denial of service.

A low impact flaw was found in the Linux kernel's ieee802154 subsystem. When an IEEE 802.15.4 (WPAN) device is switched between network namespaces, the cfg802154_switch_netns() function calls WARN_ON() if dev_change_net_namespace() or device_rename() fails with -ENOMEM. These warnings produce only useless kernel log splats, typically observed under deliberate fault injection, and do not cause memory corruption, arbitrary code execution, or a direct security-relevant denial of service. Triggering the behavior requires local access to perform the network namespace operation together with an induced memory allocation failure, so the practical consequence is limited to kernel log pollution; a system-wide availability impact is only possible on systems where panic_on_warn is enabled, because a WARN_ON then results in a kernel panic. For this reason Red Hat Product Security rates this flaw Low impact, although the Red Hat CVSSv3 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects the theoretical availability impact. The upstream fix simply removes the unnecessary WARN_ON() calls; because this is a warning-handling cleanup with minimal security consequence, the fix is deferred for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams, leaving a residual risk of kernel log pollution (or a panic on panic_on_warn systems). Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.