CVE-2026-46152
published 2026-05-28CVE-2026-46152: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is…
PriorityP344high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.17%
6.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 3468e1e0c639032a603450f0830ccabfa76f5806 < 03584528bfffb195e384698af9148b94e42e3f14 | 03584528bfffb195e384698af9148b94e42e3f14 |
| linux | linux | >= 3468e1e0c639032a603450f0830ccabfa76f5806 < 1739fc31b4de06c5c78ce0741182770fb079091e | 1739fc31b4de06c5c78ce0741182770fb079091e |
| linux | linux | >= 3468e1e0c639032a603450f0830ccabfa76f5806 < e131562d6f2b958148c35c98831b007f47f0e3d3 | e131562d6f2b958148c35c98831b007f47f0e3d3 |
| linux | linux | >= 3468e1e0c639032a603450f0830ccabfa76f5806 < 3ef44f96ccc3e06e059dec57842e366f0c4b1893 | 3ef44f96ccc3e06e059dec57842e366f0c4b1893 |
| linux | linux | >= 3468e1e0c639032a603450f0830ccabfa76f5806 < 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba | 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.13 < 6.18.30 | 6.18.30 |
| linux | linux_kernel | >= 6.19 < 7.0.7 | 7.0.7 |
| linux | linux_kernel | >= 6.4 < 6.6.140 | 6.6.140 |
| linux | linux_kernel | >= 6.7 < 6.12.88 | 6.12.88 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result
vendor_redhat·2026-05-28·CVSS 7.0
CVE-2026-46152 [HIGH] CWE-1058 kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result
kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result
A flaw was found in the Linux kernel's Wi-Fi (mac80211) subsystem. The `ieee80211_invoke_fast_rx()` function uses a static variable for `rx_result`, which is shared across concurrent calls. This can lead to incorrect processing of Wi-Fi packets, where a packet might be mishandled or its status incorrectly reported. Such issues can result in unexpected network behavior or a denial of service within the wireless communication.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Under investigation
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Affe
GHSA
GHSA-j32m-c4xq-vrpg: In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast
ghsa_unreviewed·2026-05-28
CVE-2026-46152 GHSA-j32m-c4xq-vrpg: In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/03584528bfffb195e384698af9148b94e42e3f14https://git.kernel.org/stable/c/1739fc31b4de06c5c78ce0741182770fb079091ehttps://git.kernel.org/stable/c/3ef44f96ccc3e06e059dec57842e366f0c4b1893https://git.kernel.org/stable/c/7a5b81e0c87a075afd572f659d8eb68c9c4cd2bahttps://git.kernel.org/stable/c/e131562d6f2b958148c35c98831b007f47f0e3d3https://access.redhat.com/errata/RHSA-2026:26427https://access.redhat.com/errata/RHSA-2026:26428https://access.redhat.com/errata/RHSA-2026:27288https://access.redhat.com/errata/RHSA-2026:27789https://access.redhat.com/errata/RHSA-2026:36767https://access.redhat.com/errata/RHSA-2026:38902https://access.redhat.com/security/cve/CVE-2026-46152https://bugzilla.redhat.com/show_bug.cgi?id=2482563https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46152.json
2026-05-28
Published