All vulnerabilities
CVE-2026-98195

Linux: wifi: iwlegacy: fix broadcast stations deallocation

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in275d474a4b4bd4e73b18b1452f12e78806a8843aAlso 526fdd45548e22eee50ee1062abd88269d9f32e0, 85d847ff71fe736cbc15ada321256818e630e205 and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 275d474a4b4bd4e73b18b1452f12e78806a8843aLinuxCVE List
  • 526fdd45548e22eee50ee1062abd88269d9f32e0LinuxCVE List
  • 85d847ff71fe736cbc15ada321256818e630e205LinuxCVE List
  • 1d84c2a3de449aceb94ed79eaefecdf1bedb6468LinuxCVE List
  • 55d34422c0d91436983028fd3c1546a1c2bee55fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlegacy: fix broadcast stations deallocation

On the error path of __il4965_up(), il_dealloc_bcast_stations() clears only IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the same broadcast stations to be deallocated again by __il4965_down().

This can occur when RF_KILL is toggled during driver startup.

To fix clear the entire 'used' field, since we will not do any other operations on the station.

Text from CVE List

Affected versions 18

  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before 275d474a4b4bd4e73b18b1452f12e78806a8843aCVE List
  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before 526fdd45548e22eee50ee1062abd88269d9f32e0CVE List
  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before c9a116d691364cd7f59d8329b395adcaf826d5c6CVE List
  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before 85d847ff71fe736cbc15ada321256818e630e205CVE List
  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before 1d84c2a3de449aceb94ed79eaefecdf1bedb6468CVE List
  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before 55d34422c0d91436983028fd3c1546a1c2bee55fCVE List
  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before a9176fe666af1730cab92350f9c8cf67ebf14439CVE List
  • Linuxaffected: c2fd34469d1623111e3c3db65cde533f3bddc26e before b5526b780f8b297a76030410b96ba29153afb98fCVE List
  • Linuxaffected: 4.7CVE List
  • Linuxunaffected: all versions before 4.7CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8