---
id: "CVE-2026-98708"
kind: "vulnerability"
aliases: ["CVE-2026-98708"]
title: "Linux kernel: Wi-Fi channel context freed too early, stale pointer reuse"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "linux", "mac80211", "wifi"]
not_affected_if: ["no-wifi-hardware"]
published_at: "2026-10-18T16:17:24+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:18:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98708", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: Wi-Fi channel context freed too early, stale pointer reuse

In the Linux kernel's mac80211 Wi-Fi stack, an old channel context can be freed while its replacement still points back to it, leaving a dangling pointer. The sources do not say what an attacker can do with the stale pointer beyond the memory-safety fault it implies.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds listed in the NVD entry
- `lsmod | grep mac80211` to see whether the mac80211 Wi-Fi stack is loaded
- unknown for other checks: the sources do not say

## Fix

- Update the Linux kernel to a release that includes the upstream mac80211 fix (commit subject: 'wifi: mac80211: keep paired old chanctx alive'); the exact version is unknown from the sources
- Until patched, unknown mitigation: the sources do not say

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98708

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: keep paired old chanctx alive

An in-place replacement keeps reciprocal replace_ctx pointers between
the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx.
However, the early free paths only consider assigned and reserved link
users when deciding whether to free the old chanctx.

That lets the old chanctx be freed too early while the replacement
partner still points back to it, either when the last assigned link is
released or when that link successfully reassigns to another existing
context. Later unreserve and switch-finalization paths can then follow a
stale replace_ctx pointer.

Keep a paired old chanctx alive until the replacement pair has been torn
down. Apply the same check to both __ieee80211_link_release_channel()
and ieee80211_link_use_reserved_reassign(). If the replacement is later
abandoned, ieee80211_link_unreserve_chanctx() already tears down the
pairing before freeing the old chanctx once no users remain.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_