All vulnerabilities
CVE-2026-98708

Linux: wifi: mac80211: keep paired old chanctx alive

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8Also 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2, 1c82d0c5d509179ba2a4edfa096f516aebf960b0 and 1 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8LinuxCVE List
  • 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2LinuxCVE List
  • 1c82d0c5d509179ba2a4edfa096f516aebf960b0LinuxCVE List
  • 3412e9a800786d1dec4a58367db1cba275e7ef11LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: keep paired old chanctx alive

An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider assigned and reserved link users when deciding whether to free the old chanctx.

That lets the old chanctx be freed too early while the replacement partner still points back to it, either when the last assigned link is released or when that link successfully reassigns to another existing context. Later unreserve and switch-finalization paths can then follow a stale replace_ctx pointer.

Keep a paired old chanctx alive until the replacement pair has been torn down. Apply the same check to both __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign(). If the replacement is later abandoned, ieee80211_link_unreserve_chanctx() already tears down the pairing before freeing the old chanctx once no users remain.

Text from CVE List

Affected versions 12

  • Linuxaffected: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8CVE List
  • Linuxaffected: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2CVE List
  • Linuxaffected: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before 1c82d0c5d509179ba2a4edfa096f516aebf960b0CVE List
  • Linuxaffected: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before afd1cdd16a25c7185b812a612ab7d5f2cbd1e086CVE List
  • Linuxaffected: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before 3412e9a800786d1dec4a58367db1cba275e7ef11CVE List
  • Linuxaffected: 3.17CVE List
  • Linuxunaffected: all versions before 3.17CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5