CVE-2026-98341
Received Received - Intake

Use-After-Free in Linux Kernel WiFi Subsystem

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it owns the request, since the cancellation is (intended to be) asynchronous. The WARN_ON() in the netdev notifier was meant to catch this, but it's not actually avoidable, so it triggers and we get a UAF in scan_done(). There doesn't seem to be a great way around it, so just track that the driver is still convinced it owns the request, and then just free it on completion if it was already cancelled. Also remove the warnings since they can trigger in the intended architecture.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98341
EUVD
EUVD-2026-93326

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 4a58e7c38443154fce1b47910e1a9184f65c5d72
Linux Linux 4a58e7c38443154fce1b47910e1a9184f65c5d72
Linux Linux 4a58e7c38443154fce1b47910e1a9184f65c5d72
Linux Linux 3.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's wifi configuration subsystem (cfg80211). When a network interface goes down during an active scan, the system attempts to free the scan request while the driver still believes it owns the request. This race condition triggers a warning and leads to a UAF in the scan_done function.

Detection Guidance

This vulnerability is specific to the Linux kernel's wifi subsystem and may not have direct detection commands. Monitor kernel logs for warnings related to scan requests or interface down events. Check for crashes in wifi-related processes or kernel panics.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or potentially execute arbitrary code with kernel privileges. It affects systems using vulnerable Linux kernel versions where wifi scanning is performed while interfaces are being brought down.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. Avoid bringing network interfaces down while scans are running if possible. Monitor system logs for related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98341. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart