{"id":"CVE-2026-98823","kind":"vulnerability","aliases":["CVE-2026-98823"],"related":[],"title":"Linux kernel: Wi-Fi scan merge can double-free beacon information elements","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: preserve hidden-group beacon IE ownership\n\nA hidden-group probe-response entry borrows its beacon IEs from the\ngroup's beacon entry. cfg80211_update_assoc_bss_entry() can pass such\nan entry to cfg80211_update_known_bss() when merging scan entries\nafter a channel switch.\n\nCopying the borrowed beacon_ies into the associated entry gives the\nsame allocation two owners. Releasing the group's beacon entry can\nthen leave the associated entry pointing to freed IEs, which are\nfreed again when that entry is released.\n\nSkip beacon IE replacement when the source entry belongs to a hidden\ngroup. Preserve probe-response processing, the subsequent metadata\nupdates, and the existing rejection path for conflicting hidden\nbeacon updates.","summary":"In the Linux wireless stack (cfg80211), merging scan entries after a channel switch can give one buffer two owners, so freeing a hidden-group beacon entry leaves a pointer to freed memory that is freed again. The sources do not state the attacker's reach beyond a memory-corruption flaw in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cfg80211","kernel","linux","runtime","self-hosted","wifi"],"not_affected_if":["no-wifi-hardware","wireless-stack-not-loaded"],"how_to_check":"- Run `uname -r` and compare the kernel version with the fixed release in the kernel stable advisory unknown\n- Check whether the machine uses Wi-Fi with the `cfg80211` module loaded: `lsmod | grep cfg80211`","fix":"- Update the Linux kernel to a release that includes the upstream fix for cfg80211 hidden-group beacon IE ownership; fixed version numbers: unknown","status":"open","published_at":"2026-10-18T16:17:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:41+00:00","updated_at":"2026-10-25T05:14:41+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:14:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for cfg80211 hidden-group beacon IE ownership; fixed version numbers: unknown","reach":"local","title":"Linux kernel: Wi-Fi scan merge can double-free beacon information elements","impact":"high","summary":"In the Linux wireless stack (cfg80211), merging scan entries after a channel switch can give one buffer two owners, so freeing a hidden-group beacon entry leaves a pointer to freed memory that is freed again. The sources do not state the attacker's reach beyond a memory-corruption flaw in the kernel.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","wifi","cfg80211","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Double free in kernel memory could allow code execution or crashes","analyst_note":"Check the NVD entry and the upstream kernel stable commit for affected version ranges, a CVSS score, and whether a remote Wi-Fi frame can trigger the path.","how_to_check":"- Run `uname -r` and compare the kernel version with the fixed release in the kernel stable advisory unknown\n- Check whether the machine uses Wi-Fi with the `cfg80211` module loaded: `lsmod | grep cfg80211`","needs_analyst":true,"not_affected_if":["no-wifi-hardware","wireless-stack-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the cfg80211 Wi-Fi stack and a wireless interface in use are the ones to look at, most often laptops, IoT and embedded devices. Servers with no Wi-Fi hardware or with the wireless stack not loaded are unlikely to be exposed, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000683,"input_tokens":3508,"output_tokens":664,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98823':17A,20A 'alloc':156C 'assoc':123C 'associ':151C,169C 'attack':72B 'beacon':12A,54B,100C,113C,119C,147C,163C,185C,214C 'belong':192C 'beyond':75B 'borrow':111C,146C 'bss':124C,135C 'buffer':45B 'cfg80211':21B,34B,95C,121C,132C 'channel':40B,142C 'conflict':212C 'copi':144C 'corrupt':79B 'cve':15A,18A 'doubl':10A 'double-fre':9A 'element':14A 'entri':37B,55B,110C,120C,125C,130C,139C,152C,164C,170C,181C,191C 'exist':208C 'fi':5A 'flaw':80B 'follow':89C 'free':11A,49B 'freed':60B,64B,173C,177C 'give':43B,153C 'group':53B,99C,106C,117C,161C,196C 'hidden':52B,98C,105C,195C,213C 'hidden-group':51B,97C,104C 'host':27B 'ie':101C,114C,148C,174C,186C 'inform':13A 'kernel':2A,22B,83B,87C 'known':134C 'leav':56B,167C 'linux':1A,23B,31B,86C 'memori':61B,78B 'memory-corrupt':77B 'merg':7A,35B,137C 'metadata':204C 'one':44B 'owner':47B,158C 'ownership':102C 'pass':127C 'path':210C 'point':171C 'pointer':58B 'preserv':96C,197C 'probe':108C,199C 'probe-respons':107C,198C 'process':201C 'reach':74B 'reject':209C 'releas':159C,183C 'replac':187C 'resolv':93C 'respons':109C,200C 'runtim':24B 'scan':6A,36B,138C 'self':26B 'self-host':25B 'skip':184C 'sourc':67B,190C 'stack':33B 'state':70B 'subsequ':203C 'switch':41B,143C 'two':46B,157C 'updat':122C,133C,205C,215C 'vulner':90C 'wi':4A 'wi-fi':3A 'wifi':28B,94C 'wireless':32B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the cfg80211 Wi-Fi stack and a wireless interface in use are the ones to look at, most often laptops, IoT and embedded devices. Servers with no Wi-Fi hardware or with the wireless stack not loaded are unlikely to be exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98823","severity":null,"published_at":"2026-10-18T16:17:36+00:00","modified_at":"2026-10-21T13:21:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}