CVE-2026-64568
Received Received - Intake

Double Free in Linux Kernel wifi: mac80211

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.unsol_bcast_probe_resp still points at the object already queued for freeing. A later update or AP teardown re-queues that same rcu_head; the second free is caught by KASAN when the RCU sheaf is processed in softirq: BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850) Free of addr ffff88800d06f300 by task exploit/145 ... __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940) rcu_free_sheaf (mm/slub.c:5850) rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-128 of size 128 Queue the old object for kfree_rcu() only after the new one is published, matching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64568
EUVD
EUVD-2026-53262

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in the Linux kernel's wifi subsystem. It occurs in the mac80211 module when handling unsolicited broadcast probe responses. The function ieee80211_set_unsol_bcast_probe_resp() frees an old template before allocating a new one. If allocation fails, the old pointer remains, leading to a second free when the object is re-queued later.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and may not have direct network detection commands. Monitor kernel logs for KASAN double-free errors or crashes related to wifi operations. Check for kernel oops or warnings in dmesg output after wifi-related operations.

Impact Analysis

This vulnerability could cause system crashes or instability by triggering a kernel double-free error. It may lead to denial-of-service conditions or potential privilege escalation if exploited. Systems using vulnerable Linux kernel versions with wifi functionality are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a kernel-level memory management issue in the Linux wifi subsystem. It causes a double-free error in the mac80211 module but does not involve data exposure or unauthorized access that would typically trigger regulatory compliance concerns.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. If immediate patching is not possible, consider disabling wifi functionality or restricting access to wifi interfaces until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart