---
id: "CVE-2026-98709"
kind: "vulnerability"
aliases: ["CVE-2026-98709"]
title: "Linux kernel: mac80211 wifi channel context use-after-free during replacement"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "laptops", "linux-kernel", "mac80211", "wifi"]
not_affected_if: ["kernel-patched", "no-mac80211-wifi"]
published_at: "2026-10-18T16:17:24+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:17:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98709", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: mac80211 wifi channel context use-after-free during replacement

In the Linux kernel's mac80211 Wi-Fi stack, a replacement check counts links that belong to a different channel-context replacement, so a context can be freed while a link and the driver still use it. The likely result is a use-after-free during beacon generation, which can crash the kernel or potentially lead to code execution, though the sources do not state the impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it with the fixed release listed in the kernel stable tree or distribution advisory.
- Check whether a Wi-Fi driver using mac80211 is loaded with `lsmod | grep mac80211`.
- unknown for a more specific check; the sources do not say.

## Fix

- Update the Linux kernel to a release that includes the upstream commit 'wifi: mac80211: count only matching reservations in reserved switch'.
- unknown for exact fixed version numbers; the sources do not give them.

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98709

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: count only matching reservations in reserved switch

ieee80211_vif_use_reserved_switch() validates a replacement by counting
assigned links on ctx->replace_ctx and treating reservations too
broadly. A link can still be assigned to the old channel context while
holding a reservation that belongs to a different replacement
operation.

That can make the current replacement appear complete too early. If
another link finalizes first, the function can free the
WILL_BE_REPLACED chanctx while the unmatched link and driver still use
it, leading to a use-after-free in later beacon generation.

Require an in-place reservation to point at the current replacement
context, and require the reserved and assigned contexts to be the
matching replacement pair, before counting or moving the link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_