Live › vulnerability › CVE-2026-98708
Go to dashboardIn the Linux kernel's mac80211 Wi-Fi stack, an old channel context can be freed while its replacement still points back to it, leaving a dangling pointer. The sources do not say what an attacker can do with the stale pointer beyond the memory-safety fault it implies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the mac80211 Wi-Fi stack and a Wi-Fi interface that uses in-place channel context replacement, such as multi-link or channel-switch setups. Servers without Wi-Fi hardware and kernels built without mac80211 are unlikely to be affected; the sources do not confirm this scope.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed in the NVD entrylsmod | grep mac80211 to see whether the mac80211 Wi-Fi stack is loadedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: keep paired old chanctx alive
An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider assigned and reserved link users when deciding whether to free the old chanctx.
That lets the old chanctx be freed too early while the replacement partner still points back to it, either when the last assigned link is released or when that link successfully reassigns to another existing context. Later unreserve and switch-finalization paths can then follow a stale replace_ctx pointer.
Keep a paired old chanctx alive until the replacement pair has been torn down. Apply the same check to both __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign(). If the replacement is later abandoned, ieee80211_link_unreserve_chanctx() already tears down the pairing before freeing the old chanctx once no users remain.
This page as .md · .json · in your agent: get_signal("CVE-2026-98708")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.