CVE-2026-64574
Received Received - Intake

Use-After-Free in Linux Kernel mac80211 Subsystem

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211_vif_update_links() adds new links it allocates a link container for each and calls ieee80211_link_init() (which registers the per-link debugfs files with file->private_data pointing into the container) and ieee80211_link_setup(). If the subsequent drv_change_vif_links() fails, the error path restores the old pointers and jumps to 'free', which frees the new containers but never removes their debugfs entries or stops the links. The debugfs files survive with file->private_data dangling at the freed container, so a later open()+read() (e.g. link-1/txpower) dereferences freed memory in ieee80211_if_read_link(), a use-after-free. The removal path already dismantles links correctly via ieee80211_tear_down_links(), which removes each link's keys and debugfs entries and calls ieee80211_link_stop(); the add path on the error branch does not. Commit be1ba9ed221f ("wifi: mac80211: avoid weird state in error path") hardened this same error path for the link-removal case (new_links == 0) but left the newly-added links' teardown unaddressed. drv_change_vif_links() can fail at runtime on MLO drivers (internal allocation / queue / firmware command failures). Remove the new links' debugfs entries and stop them before freeing. BUG: KASAN: slab-use-after-free in ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) Read of size 8 at addr ffff888011290000 by task exploit/145 Call Trace: ... ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) short_proxy_read (fs/debugfs/file.c:373) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) ... Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a RIP: 0010:ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) Kernel panic - not syncing: Fatal exception

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64574
EUVD
EUVD-2026-53268

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's WiFi subsystem (mac80211). When updating wireless interface links, the code fails to properly clean up newly created debugfs entries and link states if an error occurs during driver operations. This leaves dangling pointers that can be accessed later, causing memory corruption when reading from debugfs files like link-1/txpower.

Detection Guidance

This vulnerability involves a use-after-free in the Linux kernel's mac80211 subsystem related to WiFi link management. Detection requires kernel logging and memory analysis tools. Check kernel logs for slab-use-after-free errors in mac80211 or debugfs operations. Use commands like dmesg | grep -i "KASAN\|use-after-free\|mac80211" to identify related crashes or warnings.

Impact Analysis

An attacker could exploit this to crash the system (kernel panic), execute arbitrary code with kernel privileges, or cause denial-of-service conditions. The vulnerability requires local access to trigger via debugfs file operations, but successful exploitation could lead to complete system compromise.

Compliance Impact

This vulnerability is a kernel-level use-after-free flaw in the Linux WiFi subsystem that could lead to memory corruption and system instability. It does not directly relate to data privacy or access controls required by standards like GDPR or HIPAA. Compliance impact would be indirect if the flaw causes system crashes or unauthorized access, but no evidence in the provided text links it to specific regulatory violations.

Mitigation Strategies

Apply the latest kernel security updates immediately. If using a vulnerable kernel version, avoid enabling mac80211-based WiFi features or disable WiFi interfaces until patched. Monitor vendor advisories for kernel updates addressing CVE-2026-64574.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart