Live › vulnerability › CVE-2026-98709
Go to dashboardIn the Linux kernel's mac80211 Wi-Fi stack, a replacement check counts links that belong to a different channel-context replacement, so a context can be freed while a link and the driver still use it. The likely result is a use-after-free during beacon generation, which can crash the kernel or potentially lead to code execution, though the sources do not state the impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with mac80211 Wi-Fi support and an affected wireless driver, such as laptops, embedded devices, or access-point hosts that use Wi-Fi channel switching. Systems without mac80211 wireless hardware or with the kernel updated can skip it. The sources do not say which drivers or configurations trigger the replacement path.
No product ranges from the sources yet.
uname -r and compare it with the fixed release listed in the kernel stable tree or distribution advisory.lsmod | grep mac80211.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: count only matching reservations in reserved switch
ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation.
That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation.
Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.
This page as .md · .json · in your agent: get_signal("CVE-2026-98709")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.