{"id":"CVE-2026-98704","kind":"vulnerability","aliases":["CVE-2026-98704"],"related":[],"title":"Linux kernel: Wi-Fi association reads freed memory on non-transmitted MBSSID profiles","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: keep fallback association elements alive\n\nAssociating to a non-transmitted MBSSID profile reads freed memory while\ndetermining the operating channel and applying HT capabilities.\n\nWhen an association response omits WMM, HT, or VHT information,\nieee80211_assoc_config_link() parses the cached BSS IEs and copies the\nmissing element pointers out of that fallback parse. For a\nnon-transmitted MBSSID profile those pointers refer to merged-profile\nstorage owned by the parse object, and the fallback block frees that\nobject at its end. The copied pointers are used afterwards to determine\nthe operating channel, configure bandwidth, and apply HT capabilities.\n\nKeep the fallback parse result alive until association setup finishes.\n\n[reorder variable declaration]","summary":"When a Linux machine associates with a non-transmitted MBSSID Wi-Fi profile, the mac80211 code reads memory it has already freed while picking the channel and applying HT settings. The sources do not describe what an attacker can achieve beyond the memory read and crash risk.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","laptops","linux-kernel","mac80211","runtime","wifi"],"not_affected_if":["no-wifi","wired-only"],"how_to_check":"- Run `uname -r` and compare against the kernel version that contains the upstream fix for CVE-2026-98704 (unknown in the sources)\n- Check whether the mac80211 Wi-Fi stack is in use with `lsmod | grep mac80211`","fix":"- Update the Linux kernel to a release that includes the upstream commit for CVE-2026-98704 (exact version unknown in the sources)","status":"open","published_at":"2026-10-18T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:52+00:00","updated_at":"2026-10-25T05:18:52+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:18:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for CVE-2026-98704 (exact version unknown in the sources)","reach":"network","title":"Linux kernel: Wi-Fi association reads freed memory on non-transmitted MBSSID profiles","impact":"medium","summary":"When a Linux machine associates with a non-transmitted MBSSID Wi-Fi profile, the mac80211 code reads memory it has already freed while picking the channel and applying HT settings. The sources do not describe what an attacker can achieve beyond the memory read and crash risk.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","wifi","mac80211","laptops","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; freed memory is read during Wi-Fi association","analyst_note":"Find the fixed kernel versions and the upstream commit for CVE-2026-98704 in the kernel stable git tree or the NVD entry, and confirm whether a remote attacker can trigger it.","how_to_check":"- Run `uname -r` and compare against the kernel version that contains the upstream fix for CVE-2026-98704 (unknown in the sources)\n- Check whether the mac80211 Wi-Fi stack is in use with `lsmod | grep mac80211`","needs_analyst":true,"not_affected_if":["no-wifi","wired-only"],"who_is_affected":"Machines using Linux mac80211 Wi-Fi drivers that associate with access points advertising non-transmitted MBSSID profiles. Systems without mac80211 Wi-Fi, such as wired-only servers, can skip it. The sources do not say how an attacker would trigger the flawed path remotely.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00067,"input_tokens":3488,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98704':18A,21A 'achiev':71B 'afterward':181C 'aliv':95C,198C 'alreadi':52B 'appli':59B,113C,190C 'assoc':127C 'associ':6A,34B,93C,96C,118C,200C 'attack':69B 'bandwidth':188C 'beyond':72B 'block':169C 'bss':133C 'cach':132C 'capabl':115C,192C 'channel':57B,111C,186C 'code':47B 'config':128C 'configur':187C 'copi':136C,177C 'crash':77B 'cve':16A,19A 'declar':205C 'describ':66B 'determin':108C,183C 'element':94C,139C 'embed':22B 'end':175C 'fallback':92C,144C,168C,195C 'fi':5A,43B 'finish':202C 'follow':84C 'free':170C 'freed':8A,53B,105C 'ht':60B,114C,122C,191C 'ie':134C 'ieee80211':126C 'inform':125C 'keep':91C,193C 'kernel':2A,26B,82C 'laptop':23B 'link':129C 'linux':1A,25B,32B,81C 'linux-kernel':24B 'mac80211':27B,46B,90C 'machin':33B 'mbssid':14A,40B,102C,151C 'memori':9A,49B,74B,106C 'merg':158C 'merged-profil':157C 'miss':138C 'non':12A,38B,100C,149C 'non-transmit':11A,37B,99C,148C 'object':165C,172C 'omit':120C 'oper':110C,185C 'own':161C 'pars':130C,145C,164C,196C 'pick':55B 'pointer':140C,154C,178C 'profil':15A,44B,103C,152C,159C 'read':7A,48B,75B,104C 'refer':155C 'reorder':203C 'resolv':88C 'respons':119C 'result':197C 'risk':78B 'runtim':28B 'set':61B 'setup':201C 'sourc':63B 'storag':160C 'transmit':13A,39B,101C,150C 'use':180C 'variabl':204C 'vht':124C 'vulner':85C 'wi':4A,42B 'wi-fi':3A,41B 'wifi':29B,89C 'wmm':121C","nicknames":[],"mitigations":[],"who_affected":"Machines using Linux mac80211 Wi-Fi drivers that associate with access points advertising non-transmitted MBSSID profiles. Systems without mac80211 Wi-Fi, such as wired-only servers, can skip it. The sources do not say how an attacker would trigger the flawed path remotely.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98704","severity":null,"published_at":"2026-10-18T16:17:23+00:00","modified_at":"2026-10-21T13:21:38+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}