CVE-2026-97474

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwlwifi: mld: purge async notifications upon nic error<br /> <br /> This fixes a kernel panic in reconfig failure:<br /> <br /> 1. we have a BSS connection<br /> 2. we have a NAN connection<br /> 3. FW error occurs<br /> 4. reconfig restores the BSS connection<br /> 5. however, restoring the NAN connection fails due to a FW error.<br /> 6. erroneously, ieee80211_handle_reconfig_failure is called and marks all<br /> interfaces as not-in-driver (will be fixed in a different patch).<br /> 7. mac80211 frees the links of the BSS connection but doesn&amp;#39;t tell the<br /> driver about that, as it thinks that this vif is not in the driver.<br /> 8. in ieee80211_stop_device, *ALL* wiphy works are getting flushed<br /> (erroneously?)<br /> 9. Therefore, async_handlers_wk is being executed, processing the<br /> statistics notification that was received after we restored the BSS<br /> connection.<br /> 10. the notification handler dereferences fw_id_to_bss_conf[id], which is<br /> now a dangling pointer, as mac80211 already freed this link in (7).<br /> 11. On the first access to one of the links fields, we panic.<br /> <br /> While this can and should be fixed by removing the call to<br /> ieee80211_handle_reconfig_failure in (6), it is also not a good idea to<br /> carry and maybe handle notifications from a dead FW.<br /> <br /> We do purge the notifications when we stop the FW, but in reconfig<br /> failure we stop the FW too late, after the notifications are processed.<br /> In addition, async_handlers_wk can always be scheduled before the<br /> reconfig work.<br /> <br /> Purge the notifications immediately when transport notifies about a nic<br /> error.