CVE-2026-93804

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A race condition can occur when disconnecting from an Independent Basic Service Set (IBSS, an ad-hoc wireless network) while network traffic is simultaneously being transmitted across processor cores. This timing conflict causes data packets to reach the wireless driver after disconnection has initiated, which may trigger driver instability and lead to a Denial of Service (DoS) or system crash.

A moderate-severity race condition flaw was found in the Linux kernel's mac80211 wireless subsystem. While leaving an IBSS (ad-hoc wireless network) in ieee80211_ibss_disconnect(), mac80211 flushes stations, turns the carrier off, and immediately tells the driver to leave, but due to cross-CPU race conditions packets could still be transmitted after the carrier was turned off. As a result, a transmit operation could reach the wireless driver while or after it was told to leave the IBSS; in the iwlwifi driver this leads to an attempt to use invalid queues, which can cause driver instability, a kernel crash, and a denial of service. Exploiting this flaw requires local access with privileges sufficient to manage wireless network configuration (for example CAP_NET_ADMIN to disconnect from an IBSS) and winning a narrow timing window while traffic is being transmitted across processors. Only availability is affected; there is no impact on confidentiality or integrity. Red Hat rated this flaw Moderate with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Affected Red Hat products include the Red Hat Enterprise Linux kernel and kernel-rt packages across supported RHEL streams, the Red Hat In-Vehicle OS kernels, and the OpenShift Container Platform RHCOS kernels; for these the fix has been deferred because triggering the flaw requires local privileged access to the IBSS disconnect path and the impact is limited to availability, so the fix will be delivered in a future planned kernel update rather than an immediate update. The residual risk of the deferral is a local denial of service (system crash) on systems that use IBSS ad-hoc wireless networking. The Red Hat Enterprise Linux 6 kernel stream is out of secondary support and will not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is only reached when leaving an IBSS (ad-hoc) wireless network. As a workaround, avoid using IBSS/ad-hoc mode on affected systems; using infrastructure-mode wireless networks avoids this code path. Otherwise, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.