CVE-2026-46166: wifi: mac80211: use safe list iteration in radar detect work

Synopsis

A use-after-free vulnerability exists in the Linux kernel's mac80211 Wi-Fi subsystem, specifically in the radar detection work path. An attacker on the same network segment can reach the affected service without authentication and trigger the flaw by sending crafted wireless frames that cause a channel-context structure to be freed while still being iterated. Successful exploitation gives the attacker full read, write, and crash capabilities against the affected kernel. Patched-image rebuilds at versions 6.12.88, 6.18.30, and 7.0.7 are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The vulnerability is reachable from an adjacent network such as a local LAN, Wi-Fi segment, or VPN; remote over-the-internet exploitation without LAN-level access is not possible.

• AuthenticationNot required

  No account credentials or session tokens are needed; an unauthenticated attacker on the adjacent network can trigger the flaw.

• Victim interactionNot required

  No user action is required; the attacker can initiate the exploit entirely without any interaction from a logged-in user.

• Attack complexityDetail

  Exploit reliability is high and no special race conditions or environmental prerequisites are required; a straightforward crafted wireless frame sequence is sufficient.

Blast Radius

• Reads kernel memory, which may expose session tokens, cryptographic material, or other in-memory secrets from any process on the host.
• Writes to kernel memory structures, allowing an attacker to modify persisted data, escalate privileges, or inject arbitrary code into the running kernel.
• Crashes the affected kernel, taking down all workloads on the host and causing a full service outage.
• Compromises the integrity of the host OS, potentially undermining container isolation boundaries for co-located workloads.