---
title: "CVE-2026-90343: CVE-2026-90343"
description: "In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wireless_dev is still present in the driver. cfg80211_leave_locked() and cfg80211_stop_pd() already do this before invoking the driver's stop callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not. Those helpers are also called directly by nl80211, rfkill shutdown, and wireless_dev unregister paths. If one of these paths stops a P2P device or NAN interface with a pending request, it removes the mac80211 subinterface from the driver first. Subsequent request cleanup cannot reach the lower driver's abort callback, but cfg80211 frees the request regardless. Driver state can then retain a stale request and use it when it later reports a result. Call cfg80211_pmsr_wdev_down() before stopping the P2P device or NAN interface. This keeps lower-driver request state and cfg80211 request ownership in sync for all of the helpers' callers."
url: https://panop.io/threat-heartbeat/CVE-2026-90343/
---

# CVE-2026-90343 CVE-2026-90343

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wireless\_dev is still present in the driver. cfg80211\_leave\_locked() and cfg80211\_stop\_pd() already do this before invoking the driver's stop callback, but cfg80211\_stop\_p2p\_device() and cfg80211\_stop\_nan() do not. Those helpers are also called directly by nl80211, rfkill shutdown, and wireless\_dev unregister paths. If one of these paths stops a P2P device or NAN interface with a pending request, it removes the mac80211 subinterface from the driver first. Subsequent request cleanup cannot reach the lower driver's abort callback, but cfg80211 frees the request regardless. Driver state can then retain a stale request and use it when it later reports a result. Call cfg80211\_pmsr\_wdev\_down() before stopping the P2P device or NAN interface. This keeps lower-driver request state and cfg80211 request ownership in sync for all of the helpers' callers.

CVSS base score 7.8 /10

High

CISA KEV

Not listed

Public exploit

None known

EPSS

0.17% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-90343)

## Details

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

17 September 2026

Updated

15 October 2026

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-90343](https://nvd.nist.gov/vuln/detail/CVE-2026-90343)
- [https://git.kernel.org/stable/c/6c5fc504d0d6934132637aa3db4b9b58148eaa78](https://git.kernel.org/stable/c/6c5fc504d0d6934132637aa3db4b9b58148eaa78)
- [https://git.kernel.org/stable/c/7a22cbc6c6bdd3c3811b4ce13875685c520f94de](https://git.kernel.org/stable/c/7a22cbc6c6bdd3c3811b4ce13875685c520f94de)
- [https://git.kernel.org/stable/c/db3439ad11ac5e52decdefe784c98b21c3757848](https://git.kernel.org/stable/c/db3439ad11ac5e52decdefe784c98b21c3757848)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)