CVE-2026-46152: linux Race Condition
Vulnerability summary
CVE-2026-46152 is a high (CVSS 8.8) Race Condition vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 45 · Related 38Timeline
- 28-05-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share one instance and can overwrite each other's result between ieee80211_rx_mesh_data() and the switch on res. That can make a packet that was queued or consumed by ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make a packet that should continue return as queued. Make res an automatic variable so each invocation keeps its own result.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
14%
Versus all other CVEs
30-day change
+0.07 pp
From 0.17% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-1058Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member ElementThe code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.
Affected systems
Ubuntu139 products
- linux< 6.8.0-136.136 | All versions (No fix recorded) | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1061.64 | All versions (No fix recorded) | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 3468e1e0c639032a603450f0830ccabfa76f5806, < 03584528bfffb195e384698af9148b94e42e3f14 | ≥ 3468e1e0c639032a603450f0830ccabfa76f5806, < 1739fc31b4de06c5c78ce0741182770fb079091e | ≥ 3468e1e0c639032a603450f0830ccabfa76f5806, < e131562d6f2b958148c35c98831b007f47f0e3d3 | ≥ 3468e1e0c639032a603450f0830ccabfa76f5806, < 3ef44f96ccc3e06e059dec57842e366f0c4b1893 | ≥ 3468e1e0c639032a603450f0830ccabfa76f5806, < 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba | 6.4
- linux_kernel≥ 6.4, < 6.6.140 | ≥ 6.7, < 6.12.88 | ≥ 6.13, < 6.18.30 | ≥ 6.19, < 7.0.7 | 7.1:rc1 | 7.1:rc2
Debian1 product
- linux< 6.12.88-1 | < 7.0.7-1
3 vendors · 142 products
