PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46152 Linux CVE debrief

A race condition vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem could cause packet misrouting or state corruption under concurrent receive conditions. The ieee80211_invoke_fast_rx() function was documented as safe for parallel RX, but used a static variable for its rx_result, causing concurrent callers to share and overwrite each other's results. This could lead to packets being incorrectly processed—either falling through to ieee80211_rx_8023() when they were already queued/consumed, or returning as queued when they should continue processing. The fix converts the static variable to an automatic (stack) variable so each invocation maintains independent state.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Linux system administrators running kernels with Wi-Fi mesh (802.11s) support; embedded/IoT device manufacturers using mac80211-based wireless stacks; security teams monitoring kernel networking subsystems for race condition vulnerabilities

Technical summary

The vulnerability exists in net/mac80211/rx.c in the ieee80211_invoke_fast_rx() function. A static enum rx_result res declaration caused all concurrent invocations to share the same storage location. Under parallel RX processing, one CPU could overwrite another's result between the ieee80211_rx_mesh_data() call and the subsequent switch statement on res. This could cause: (1) packets already queued or consumed by mesh processing to incorrectly fall through to ieee80211_rx_8023(), or (2) packets that should continue processing to return RX_QUEUED. The fix changes 'static enum rx_result res' to 'enum rx_result res', making it an automatic variable with per-invocation storage. The issue affects systems using 802.11s mesh networking where fast-RX optimizations are active.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the fixed mac80211 code
  • Verify running kernel version is at or beyond the patched commits for your stable branch
  • Monitor for mesh networking anomalies if running unpatched kernels with 802.11s mesh enabled
  • Review system logs for unexpected packet processing errors in wireless interfaces

Evidence notes

Vulnerability disclosed via Linux kernel stable tree commits on 2026-05-28. The issue was a coding defect (incorrect use of static storage class) in a function explicitly documented as thread-safe for parallel execution. Multiple stable kernel branches received backported fixes.

Official resources

2026-05-28