---
id: "CVE-2026-98823"
kind: "vulnerability"
aliases: ["CVE-2026-98823"]
title: "Linux kernel: Wi-Fi scan merge can double-free beacon information elements"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cfg80211", "kernel", "linux", "runtime", "self-hosted", "wifi"]
not_affected_if: ["no-wifi-hardware", "wireless-stack-not-loaded"]
published_at: "2026-10-18T16:17:36+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:14:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98823", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel: Wi-Fi scan merge can double-free beacon information elements

In the Linux wireless stack (cfg80211), merging scan entries after a channel switch can give one buffer two owners, so freeing a hidden-group beacon entry leaves a pointer to freed memory that is freed again. The sources do not state the attacker's reach beyond a memory-corruption flaw in the kernel.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare the kernel version with the fixed release in the kernel stable advisory unknown
- Check whether the machine uses Wi-Fi with the `cfg80211` module loaded: `lsmod | grep cfg80211`

## Fix

- Update the Linux kernel to a release that includes the upstream fix for cfg80211 hidden-group beacon IE ownership; fixed version numbers: unknown

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98823

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: preserve hidden-group beacon IE ownership

A hidden-group probe-response entry borrows its beacon IEs from the
group's beacon entry. cfg80211_update_assoc_bss_entry() can pass such
an entry to cfg80211_update_known_bss() when merging scan entries
after a channel switch.

Copying the borrowed beacon_ies into the associated entry gives the
same allocation two owners. Releasing the group's beacon entry can
then leave the associated entry pointing to freed IEs, which are
freed again when that entry is released.

Skip beacon IE replacement when the source entry belongs to a hidden
group. Preserve probe-response processing, the subsequent metadata
updates, and the existing rejection path for conflicting hidden
beacon updates.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_