CVE-2021-47194: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-10 · updated 2026-08-04
Weakness: CWE-665

Description

In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type If the userspace tools switch from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it does not call the cleanup cfg80211_stop_ap(), this leads to the initialization of in-use data. For example, this path re-init the sdata->assigned_chanctx_list while it is still an element of assigned_vifs list, and makes that linked list corrupt.

Affected products

Linux kernel: from 3.6.0 before 4.4.293; from 4.5.0 before 4.9.291; from 4.10.0 before 4.14.256; from 4.15.0 before 4.19.218; from 4.20.0 before 5.4.162; from 5.5.0 before 5.10.82 — fixed in 4.14.256, 4.19.218, 4.4.293, 4.9.291, 5.10.82, 5.15.5

How to fix

Upgrade to a fixed version: Linux kernel 4.14.256, 4.19.218, 4.4.293, 4.9.291. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-47194 or the next vulnerability affects your stack