[GIT PULL] wireless-2026-02-25

[Johannes Berg <johannes@sipsolutions.net>]

Hi,

So for some reason a whole bunch of fixes came in recently,
including quite a few (potential) crashes and similar. Most
even are long-standing issues.

Please pull and let us know if there's any problem.

Thanks,
johannes



The following changes since commit 8bf22c33e7a172fbc72464f4cc484d23a6b412ba:

  Merge tag 'net-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-02-19 10:39:08 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git tags/wireless-2026-02-25

for you to fetch changes up to 017c1792525064a723971f0216e6ef86a8c7af11:

  wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (2026-02-24 10:03:10 +0100)

----------------------------------------------------------------
A good number of fixes:
 - cfg80211:
   - cancel rfkill work appropriately
   - fix radiotap parsing to correctly reject field 18
   - fix wext (yes...) off-by-one for IGTK key ID
 - mac80211:
   - fix for mesh NULL pointer dereference
   - fix for stack out-of-bounds (2 bytes) write on
     specific multi-link action frames
   - set default WMM parameters for all links
 - mwifiex: check dev_alloc_name() return value correctly
 - libertas: fix potential timer use-after-free
 - brcmfmac: fix crash on probe failure

----------------------------------------------------------------
Ariel Silver (1):
      wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

Chen-Yu Tsai (1):
      wifi: mwifiex: Fix dev_alloc_name() return value check

Daniel Hodges (1):
      wifi: libertas: fix use-after-free in lbs_free_adapter()

Daniil Dulov (1):
      wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()

Johannes Berg (2):
      wifi: cfg80211: wext: fix IGTK key ID off-by-one
      wifi: radiotap: reject radiotap with unknown bits

Marek Szyprowski (1):
      wifi: brcmfmac: Fix potential kernel oops when probe fails

Ramanathan Choodamani (1):
      wifi: mac80211: set default WMM parameters on all links

Vahagn Vardanian (1):
      wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()

 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 7 +++----
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c   | 7 ++++---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h   | 2 +-
 drivers/net/wireless/marvell/libertas/main.c              | 4 ++--
 drivers/net/wireless/marvell/mwifiex/cfg80211.c           | 2 +-
 net/mac80211/link.c                                       | 2 ++
 net/mac80211/mesh.c                                       | 3 +++
 net/mac80211/mlme.c                                       | 3 +++
 net/wireless/core.c                                       | 1 +
 net/wireless/radiotap.c                                   | 4 ++--
 net/wireless/wext-compat.c                                | 2 +-
 11 files changed, 23 insertions(+), 14 deletions(-)