CVE-2026-43052

Vulnerability

Description

In the Linux kernel's mac80211 subsystem, the function ieee80211_tdls_oper lacked a check to verify whether the target station is actually a TDLS (Tunneled Direct Link Setup) station when processing the NL80211_TDLS_ENABLE_LINK command. The code only verified that the station exists, but not its TDLS status, allowing the operation to proceed for any station [1].

Exploitation and

Attack Surface

An attacker with the ability to trigger NL80211_TDLS_ENABLE_LINK on a non-TDLS station could cause the operation to go ahead before ultimately failing. During this process, the kernel may modify channel context and HT (High Throughput) protection settings as side effects, potentially impacting wireless connectivity for other stations [1]. The attack requires local access to the system, system or the ability to send crafted netlink commands.

Impact

Successful exploitation can lead to unintended modifications of channel context and HT protection, which may degrade Wi-Fi performance or cause denial of service for legitimate wireless peers. The vulnerability does not directly allow remote code execution but can disrupt network operations [1].

Mitigation

The fix adds an early check for sta->sta.tdls in the ENABLE_LINK case, before any side effects occur, ensuring the operation is only allowed for actual TDLS peers [1]. Users should apply the kernel patches that include commit 8148c2fda4ebb17104a573649c9b699208ad10ee and related stable backports as soon as possible.