CVE-2026-46152: wifi: mac80211: drop stray 'static' from fast-RX rx_result

Synopsis

A race condition in the Linux kernel's mac80211 Wi-Fi subsystem allows concurrent wireless packet processing to corrupt shared per-invocation state. The flaw is reachable from the adjacent network (same Wi-Fi segment, LAN, or VPN) without any authentication. Successful exploitation lets an attacker read sensitive data, tamper with network traffic, or disrupt wireless service. A patched-image rebuild at fix version 6.6.140 (and the corresponding upstream commit hashes) is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment as the target, such as the same Wi-Fi network, LAN, or VPN - remote internet-based exploitation is not possible with this vector.

• AuthenticationNot required

  No credentials or session token of any kind are needed; an unauthenticated attacker on the adjacent network can trigger the race condition directly.

• Victim interactionNot required

  No user action is needed; the vulnerability is triggered purely by sending crafted wireless frames to the affected kernel.

• Attack complexityDetail

  The exploit is reliable and imposes no special environmental preconditions, though the underlying bug is a race between concurrent RX threads, meaning timing across parallel processors is involved.

Blast Radius

• An attacker can read in-flight wireless packet data, exposing session tokens, credentials, or other sensitive payload contents processed by the affected kernel.
• An attacker can cause packets to be misrouted through ieee80211_rx_8023() or incorrectly marked as queued, corrupting the integrity of received network traffic.
• A packet that should have been consumed or dropped by the mesh data path can instead be injected into the 802.3 processing path, enabling unauthorized data injection.
• Repeated exploitation of the race can cause the wireless subsystem to process packets in undefined states, crashing the affected service or destabilizing the Wi-Fi stack entirely.