{"id":"CVE-2026-98709","kind":"vulnerability","aliases":["CVE-2026-98709"],"related":[],"title":"Linux kernel: mac80211 wifi channel context use-after-free during replacement","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: count only matching reservations in reserved switch\n\nieee80211_vif_use_reserved_switch() validates a replacement by counting\nassigned links on ctx->replace_ctx and treating reservations too\nbroadly. A link can still be assigned to the old channel context while\nholding a reservation that belongs to a different replacement\noperation.\n\nThat can make the current replacement appear complete too early. If\nanother link finalizes first, the function can free the\nWILL_BE_REPLACED chanctx while the unmatched link and driver still use\nit, leading to a use-after-free in later beacon generation.\n\nRequire an in-place reservation to point at the current replacement\ncontext, and require the reserved and assigned contexts to be the\nmatching replacement pair, before counting or moving the link.","summary":"In the Linux kernel's mac80211 Wi-Fi stack, a replacement check counts links that belong to a different channel-context replacement, so a context can be freed while a link and the driver still use it. The likely result is a use-after-free during beacon generation, which can crash the kernel or potentially lead to code execution, though the sources do not state the impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","laptops","linux-kernel","mac80211","wifi"],"not_affected_if":["kernel-patched","no-mac80211-wifi"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed release listed in the kernel stable tree or distribution advisory.\n- Check whether a Wi-Fi driver using mac80211 is loaded with `lsmod | grep mac80211`.\n- unknown for a more specific check; the sources do not say.","fix":"- Update the Linux kernel to a release that includes the upstream commit 'wifi: mac80211: count only matching reservations in reserved switch'.\n- unknown for exact fixed version numbers; the sources do not give them.","status":"open","published_at":"2026-10-18T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:36+00:00","updated_at":"2026-10-25T05:17:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:17:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'wifi: mac80211: count only matching reservations in reserved switch'.\n- unknown for exact fixed version numbers; the sources do not give them.","reach":"unknown","title":"Linux kernel: mac80211 wifi channel context use-after-free during replacement","impact":"high","summary":"In the Linux kernel's mac80211 Wi-Fi stack, a replacement check counts links that belong to a different channel-context replacement, so a context can be freed while a link and the driver still use it. The likely result is a use-after-free during beacon generation, which can crash the kernel or potentially lead to code execution, though the sources do not state the impact.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","wifi","mac80211","laptops","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corruption from use-after-free, possible crash or code execution","analyst_note":"Find the fixed kernel versions and the stable-tree commit for this CVE in the kernel.org stable mailing list or the NVD entry, and confirm the reach and the auth requirement.","how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed release listed in the kernel stable tree or distribution advisory.\n- Check whether a Wi-Fi driver using mac80211 is loaded with `lsmod | grep mac80211`.\n- unknown for a more specific check; the sources do not say.","needs_analyst":true,"not_affected_if":["no-mac80211-wifi","kernel-patched"],"who_is_affected":"Systems running a Linux kernel with mac80211 Wi-Fi support and an affected wireless driver, such as laptops, embedded devices, or access-point hosts that use Wi-Fi channel switching. Systems without mac80211 wireless hardware or with the kernel updated can skip it. The sources do not say which drivers or configurations trigger the replacement path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":3483,"output_tokens":732,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98709':15A,18A 'anoth':170C 'appear':165C 'assign':126C,142C,221C 'beacon':76B,201C 'belong':43B,153C 'broad':136C 'chanctx':182C 'channel':5A,48B,146C 'channel-context':47B 'check':39B 'code':87B 'complet':166C 'context':6A,49B,53B,147C,215C,222C 'count':40B,109C,125C,230C 'crash':80B 'ctx':129C,131C 'current':163C,213C 'cve':13A,16A 'differ':46B,156C 'driver':62B,188C 'earli':168C 'embed':19B 'execut':88B 'fi':35B 'final':172C 'first':173C 'follow':102C 'free':10A,74B,177C,198C 'freed':56B 'function':175C 'generat':77B,202C 'hold':149C 'ieee80211':116C 'impact':96B 'in-plac':205C 'infrastructur':20B 'kernel':2A,24B,30B,82B,100C 'laptop':21B 'later':200C 'lead':85B,192C 'like':67B 'link':41B,59B,127C,138C,171C,186C,234C 'linux':1A,23B,29B,99C 'linux-kernel':22B 'mac80211':3A,25B,32B,108C 'make':161C 'match':111C,226C 'move':232C 'old':145C 'oper':158C 'pair':228C 'place':207C 'point':210C 'potenti':84B 'replac':12A,38B,50B,123C,130C,157C,164C,181C,214C,227C 'requir':203C,217C 'reserv':112C,114C,119C,134C,151C,208C,219C 'resolv':106C 'result':68B 'sourc':91B 'stack':36B 'state':94B 'still':63B,140C,189C 'switch':115C,120C 'though':89B 'treat':133C 'unmatch':185C 'use':8A,64B,72B,118C,190C,196C 'use-after-fre':7A,71B,195C 'valid':121C 'vif':117C 'vulner':103C 'wi':34B 'wi-fi':33B 'wifi':4A,26B,107C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with mac80211 Wi-Fi support and an affected wireless driver, such as laptops, embedded devices, or access-point hosts that use Wi-Fi channel switching. Systems without mac80211 wireless hardware or with the kernel updated can skip it. The sources do not say which drivers or configurations trigger the replacement path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98709","severity":null,"published_at":"2026-10-18T16:17:24+00:00","modified_at":"2026-10-21T13:21:39+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}