CVE-2026-97492

A flaw was found in the Linux kernel's mac80211 wireless subsystem. When reconfiguration of a Neighbor Awareness Networking (NAN) interface fails, the error path prematurely marks active interfaces as absent from the driver before completing state cleanup. This improper handling leaves wireless device drivers with dangling pointers to freed memory structures, which may allow a local attacker to cause a denial of service (DoS) or memory corruption.

A low impact flaw was found in the Linux kernel's mac80211 wireless subsystem. When reconfiguration of a Neighbor Awareness Networking (NAN) interface fails, ieee80211_handle_reconfig_failure() is called even though it is not needed, marking all interfaces as absent from the driver. During the subsequent error-path cleanup performed by cfg80211_shutdown_all_interfaces(), the driver is not informed when the state (links, stations) of other active interfaces, such as a BSS station, is removed, which can leave wireless drivers (iwlwifi, for example) with dangling pointers to freed memory structures. A later driver access to this stale state may cause a kernel crash, resulting in denial of service, or memory corruption. Exploiting this flaw requires local access and the ability to trigger wireless interface reconfiguration, which normally requires administrative (CAP_NET_ADMIN) privileges; the flaw is not reachable remotely through network traffic. This is reflected in the Red Hat impact rating of low and the Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which measures only availability impact. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernel versions. For the affected Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) streams, the fix has been deferred: given the low impact rating, the specific preconditions required to trigger the flaw, and the privileges needed, it will not be addressed in the current update cycle. The residual risk is a potential local denial of service by an attacker who already holds the required local privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.