CVE-2026-46125

If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing station. Any "new_sta" is already being removed, so that doesn't need changes.

This fixes a use-after-free/double-free in debugfs if that's enabled, because a vif going from MLD (and to MLD, but that's not relevant here) recreates its entire debugfs.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46125.json",
    "cna_assigner": "Linux"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

81151ce462e533551f3284bfdb8e0f461c9220e6

Fixed

fe75fa1ac9a92990f7fc3d34b17808fd933071b2

Fixed

afcbaed89cdc1a001b43270cbf5394bb4804270a

Fixed

9e28654f79f443bca9b29ff3ae7cf18abfba58a0

Fixed

1c2b72ea89882aeb948340498391e69c58d466f1

Fixed

283fc9e44ff5b5ac967439b4951b80bd4299f4e4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46125.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.6.140

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.88

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.30

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.0.7

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-46125.json"