CVE-2026-64570
Received Received - Intake

Double Free in Linux Kernel wifi: mac80211

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.fils_discovery still points at the object already queued for freeing. A later update or AP teardown (ieee80211_stop_ap()) re-queues that same rcu_head; the second free is caught by KASAN when the RCU sheaf is processed in softirq: BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850) Free of addr ffff88800c065280 by task swapper/0/0 ... __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940) rcu_free_sheaf (mm/slub.c:5850) rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-96 of size 96 Queue the old object for kfree_rcu() only after the new one is published, matching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64570
EUVD
EUVD-2026-53264

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in the Linux kernel's WiFi subsystem. It occurs in the mac80211 module when handling FILS discovery templates. The function ieee80211_set_fils_discovery() frees an old template before allocating a new one. If the allocation fails, the old pointer remains, leading to a double-free when the RCU cleanup runs later.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and involves a double-free issue in the FILS discovery mechanism. Detection requires checking kernel logs for KASAN double-free errors related to rcu_free_sheaf or kmalloc-96 cache. Monitor logs with dmesg or journalctl for errors like 'BUG: KASAN: double-free'.

Impact Analysis

This vulnerability could cause system crashes or instability due to the double-free error being detected by KASAN. It may lead to kernel panics or unexpected reboots, potentially disrupting network services if the affected WiFi functionality is in use.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel memory management issue with no documented data exposure or privacy implications.

Mitigation Strategies

Apply the latest kernel patch that resolves this issue. Update your Linux kernel to a version containing the fix for CVE-2026-64570. If immediate patching is not possible, disable Wi-Fi AP functionality temporarily until the patch is applied to avoid triggering the double-free condition.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart