CVE-2026-98823

Received Received - Intake

Double-Free in Linux Kernel WiFi Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211_update_assoc_bss_entry() can pass such an entry to cfg80211_update_known_bss() when merging scan entries after a channel switch. Copying the borrowed beacon_ies into the associated entry gives the same allocation two owners. Releasing the group's beacon entry can then leave the associated entry pointing to freed IEs, which are freed again when that entry is released. Skip beacon IE replacement when the source entry belongs to a hidden group. Preserve probe-response processing, the subsequent metadata updates, and the existing rejection path for conflicting hidden beacon updates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98823

EUVD

EUVD-2026-103908

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Linux	Linux	0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Linux	Linux	0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Linux	Linux	0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Linux	Linux	5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory management issue in the Linux kernel's WiFi configuration subsystem. It involves a hidden-group probe-response entry borrowing beacon information from a group's beacon entry. When the system tries to update association details, it can lead to a situation where the same memory allocation has two owners. If the original beacon entry is freed, the associated entry may still point to freed memory, causing a double-free error when the associated entry is released.

Detection Guidance

This vulnerability is specific to the Linux kernel's wifi subsystem and may not have direct detection commands. Monitor kernel logs for crashes or warnings related to cfg80211 or wifi operations. Check for kernel oops messages or unexpected disconnections.

Impact Analysis

This vulnerability could cause system crashes or instability in the Linux kernel's WiFi subsystem. It may lead to kernel panics, unexpected reboots, or denial of service conditions affecting network connectivity. Systems relying on WiFi for critical operations could experience disruptions.

Compliance Impact

This vulnerability is specific to the Linux kernel's wifi configuration and does not directly impact compliance with GDPR, HIPAA, or similar standards. It involves memory management in beacon IE ownership during wifi operations, which is unrelated to data protection or privacy regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling wifi interfaces temporarily or restricting network access until the update is applied.

Hi! I’m here to help you understand CVE-2026-98823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70