CVE-2026-98709
Received Received - Intake

WiFi Channel Context Use-After-Free in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation. That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation. Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98709
EUVD
EUVD-2026-103963

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Linux Linux 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Linux Linux 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Linux Linux 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Linux Linux 3.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's Wi-Fi subsystem. It occurs in the mac80211 module when handling channel context reservations during replacement operations. The flaw allows a link to remain assigned to an old channel context while holding a reservation for a different replacement, causing the system to prematurely free the context. This leads to a use-after-free when beacon generation occurs later.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and requires kernel-level detection. There are no direct commands to detect this issue externally. Monitor kernel logs for crashes or unusual behavior in wireless interfaces, particularly during channel switching or beacon generation. Check for use-after-free errors in dmesg or system logs.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. It affects systems using Wi-Fi with the Linux kernel, particularly those with multi-link operations. Successful exploitation requires specific conditions but could lead to system instability or unauthorized access.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this vulnerability. If immediate patching is not possible, avoid using wireless interfaces in environments with high channel switching activity. Monitor system stability and disable Wi-Fi if crashes or instability occur.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart