{"id":"CVE-2026-98708","kind":"vulnerability","aliases":["CVE-2026-98708"],"related":[],"title":"Linux kernel: Wi-Fi channel context freed too early, stale pointer reuse","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: keep paired old chanctx alive\n\nAn in-place replacement keeps reciprocal replace_ctx pointers between\nthe old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx.\nHowever, the early free paths only consider assigned and reserved link\nusers when deciding whether to free the old chanctx.\n\nThat lets the old chanctx be freed too early while the replacement\npartner still points back to it, either when the last assigned link is\nreleased or when that link successfully reassigns to another existing\ncontext. Later unreserve and switch-finalization paths can then follow a\nstale replace_ctx pointer.\n\nKeep a paired old chanctx alive until the replacement pair has been torn\ndown. Apply the same check to both __ieee80211_link_release_channel()\nand ieee80211_link_use_reserved_reassign(). If the replacement is later\nabandoned, ieee80211_link_unreserve_chanctx() already tears down the\npairing before freeing the old chanctx once no users remain.","summary":"In the Linux kernel's mac80211 Wi-Fi stack, an old channel context can be freed while its replacement still points back to it, leaving a dangling pointer. The sources do not say what an attacker can do with the stale pointer beyond the memory-safety fault it implies.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","mac80211","wifi"],"not_affected_if":["no-wifi-hardware"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD entry\n- `lsmod | grep mac80211` to see whether the mac80211 Wi-Fi stack is loaded\n- unknown for other checks: the sources do not say","fix":"- Update the Linux kernel to a release that includes the upstream mac80211 fix (commit subject: 'wifi: mac80211: keep paired old chanctx alive'); the exact version is unknown from the sources\n- Until patched, unknown mitigation: the sources do not say","status":"open","published_at":"2026-10-18T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:49+00:00","updated_at":"2026-10-25T05:18:49+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:18:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream mac80211 fix (commit subject: 'wifi: mac80211: keep paired old chanctx alive'); the exact version is unknown from the sources\n- Until patched, unknown mitigation: the sources do not say","reach":"local","title":"Linux kernel: Wi-Fi channel context freed too early, stale pointer reuse","impact":"medium","summary":"In the Linux kernel's mac80211 Wi-Fi stack, an old channel context can be freed while its replacement still points back to it, leaving a dangling pointer. The sources do not say what an attacker can do with the stale pointer beyond the memory-safety fault it implies.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","wifi","mac80211"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; stale pointer use could crash or corrupt kernel memory","analyst_note":"Find the NVD entry's affected kernel version ranges and the stable-kernel commit to give exact fixed versions and whether the trigger needs a remote or only local path.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the NVD entry\n- `lsmod | grep mac80211` to see whether the mac80211 Wi-Fi stack is loaded\n- unknown for other checks: the sources do not say","needs_analyst":true,"not_affected_if":["no-wifi-hardware"],"who_is_affected":"Systems running a Linux kernel with the mac80211 Wi-Fi stack and a Wi-Fi interface that uses in-place channel context replacement, such as multi-link or channel-switch setups. Servers without Wi-Fi hardware and kernels built without mac80211 are unlikely to be affected; the sources do not confirm this scope.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":3576,"output_tokens":678,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98708':16A,19A 'abandon':222C 'aliv':92C,192C 'alreadi':227C 'anoth':169C 'appli':201C 'assign':123C,158C 'attack':61B 'back':47B,151C 'beyond':68B 'chanctx':91C,109C,115C,135C,140C,191C,226C,236C 'channel':6A,37B,210C 'check':204C 'consid':122C 'context':7A,38B,171C 'ctx':101C,185C 'cve':14A,17A 'dangl':52B 'decid':129C 'earli':10A,118C,144C 'either':154C 'exist':170C 'fault':73B 'fi':5A,33B 'final':177C 'follow':81C,181C 'free':119C,132C,233C 'freed':8A,41B,142C 'howev':116C 'ieee80211':207C,212C,223C 'impli':75B 'in-plac':94C 'infrastructur':20B 'keep':88C,98C,187C 'kernel':2A,21B,28B,79C 'last':157C 'later':172C,221C 'leav':50B 'let':137C 'link':126C,159C,165C,208C,213C,224C 'linux':1A,22B,27B,78C 'mac80211':23B,30B,87C 'memori':71B 'memory-safeti':70B 'new':112C 'old':36B,90C,105C,134C,139C,190C,235C 'pair':89C,189C,196C,231C 'partner':148C 'path':120C,178C 'place':96C 'point':46B,150C 'pointer':12A,53B,67B,102C,186C 'reassign':167C,216C 'reciproc':99C 'releas':161C,209C 'remain':240C 'replac':44B,97C,100C,108C,113C,147C,184C,195C,219C 'reserv':125C,215C 'resolv':85C 'reus':13A 'safeti':72B 'say':58B 'sourc':55B 'stack':34B 'stale':11A,66B,183C 'still':45B,149C 'success':166C 'switch':176C 'switch-fin':175C 'tear':228C 'torn':199C 'unreserv':173C,225C 'use':214C 'user':127C,239C 'vulner':82C 'whether':130C 'wi':4A,32B 'wi-fi':3A,31B 'wifi':24B,86C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mac80211 Wi-Fi stack and a Wi-Fi interface that uses in-place channel context replacement, such as multi-link or channel-switch setups. Servers without Wi-Fi hardware and kernels built without mac80211 are unlikely to be affected; the sources do not confirm this scope.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98708","severity":null,"published_at":"2026-10-18T16:17:24+00:00","modified_at":"2026-10-21T13:21:39+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}