CVE-2026-46125: wifi: mac80211: remove station if connection prep fails

Synopsis

A use-after-free and double-free vulnerability exists in the Linux kernel's mac80211 Wi-Fi subsystem, specifically in the handling of Multi-Link Operation (MLO) connection preparation failures. An attacker on the same network segment (Wi-Fi LAN, adjacent network, or VPN) can trigger this flaw without any credentials. Successful exploitation gives the attacker full read, write, and crash capability over the affected host. Patched-image rebuilds at versions 6.6.140 and 6.12.88 (and the corresponding upstream commits) are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The vulnerable service is reachable from an adjacent network (same Wi-Fi segment, LAN, or VPN); the attacker does not need a route over the public internet but must be able to reach the target on the local link.

• AuthenticationNot required

  No credentials or prior authentication are needed; an unauthenticated attacker on the adjacent network can trigger the vulnerability.

• Victim interactionNot required

  No user action or social engineering is required; the attacker can trigger the flaw by initiating or manipulating an MLO connection attempt.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites.

Blast Radius

• The attacker gains full read access to kernel memory, enabling extraction of sensitive data such as cryptographic keys, session tokens, and credentials held in kernel space.
• The attacker gains full write access to kernel memory, allowing arbitrary modification of kernel data structures and persisted state.
• The attacker can crash the affected system by corrupting kernel memory through the double-free or use-after-free path, causing an unrecoverable kernel panic.
• If debugfs is enabled on the target, the corrupted vif debugfs state is also reachable as an exploitation surface, widening the window for memory corruption.