CVE-2026-46166

What it actually does

This vulnerability is a use-after-free flaw in the Linux kernel mac80211 Wi-Fi subsystem. During radar detection / DFS channel availability check handling, ieee80211_dfs_cac_cancel() can free and remove a channel context while it is still being iterated by radar detection work. If an attacker can trigger the vulnerable Wi-Fi code path from an adjacent wireless position, the kernel may dereference freed slab memory, potentially causing kernel memory corruption, denial of service, or, depending on exploitability on a specific build and hardware/driver combination, privilege-impacting code execution in kernel context.

Why it matters to the business

Affected Linux systems using vulnerable Wi-Fi/mac80211 functionality may be exposed to compromise or crashes from nearby wireless attackers, particularly on laptops, access points, embedded Linux devices, and appliances that rely on DFS-capable Wi-Fi. The operational risk is highest for systems with active wireless interfaces in environments where untrusted users can be physically nearby. Although EPSS is currently low and there is no known KEV listing or public exploit maturity reported, the CVSS score is high because successful exploitation can affect confidentiality, integrity, and availability at the kernel level.

How an attack unfolds

An attacker must be within wireless range of a vulnerable Linux device using the mac80211 stack and a driver/configuration that exercises DFS radar detection and channel context cancellation. The attacker attempts to influence wireless/radar-detection state transitions so that radar detect work iterates over a channel context while another operation cancels CAC and frees that same context. On an unpatched kernel, this race/logic flaw can result in a slab use-after-free. In the simplest case, the system may log a kernel warning or crash. In a more advanced scenario, an attacker would try to shape heap state and timing so the freed object is reallocated with attacker-influenced data before reuse, potentially turning memory corruption into kernel-level compromise. No public exploitation or named threat actor activity is currently indicated in the provided intelligence.

How to fix it

Upgrade to a Linux kernel version that includes the mac80211 fix changing radar detect work to use safe list iteration around ieee80211_dfs_cac_cancel(). Because no exact fixed versions were provided, obtain the patched kernel from the relevant distribution, vendor, appliance manufacturer, or upstream stable kernel channel. Prioritize systems with active Wi-Fi, DFS-capable radios, access point functionality, or exposure to untrusted nearby wireless users. Where immediate patching is not possible, reduce exposure by disabling unused Wi-Fi interfaces, disabling AP/DFS functionality where operationally feasible, avoiding DFS channels if practical, restricting wireless operation in untrusted physical locations, and applying kernel hardening features such as KASLR, slab freelist hardening, and panic-on-oops policies consistent with operational requirements.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package/build includes the mac80211 radar detect work safe-iteration patch for this issue. Validate through distribution security advisories, kernel changelogs, package metadata, or source inspection for the corrected safe list iteration pattern in the mac80211 radar detection work path. Confirm the system has rebooted into the patched kernel, not merely installed it. Check exposure by identifying systems with loaded mac80211/cfg80211 Wi-Fi components and active wireless interfaces. Review kernel logs after patching for absence of recurring KASAN, slab use-after-free, BUG, WARNING, or panic messages associated with mac80211, radar detection, DFS, CAC cancellation, or ieee80211_dfs_cac_cancel.

Typical attack path

1. Position within adjacent wireless range of a vulnerable Linux system with an active Wi-Fi interface using mac80211/DFS functionality.
2. Trigger or wait for DFS radar detection / channel availability check activity on the target wireless interface.
3. Cause or influence cancellation of CAC while radar detect work is iterating channel contexts.
4. Exploit the unsafe list iteration condition so a freed channel context is dereferenced by kernel code.
5. Leverage the resulting use-after-free for denial of service, kernel memory corruption, or potentially kernel-level code execution depending on platform mitigations and exploit reliability.

How to detect it

Look for evidence of prior exploitation or triggering in kernel logs, crash dumps, KASAN reports, pstore/ramoops records, systemd journal, distribution crash collectors, and endpoint telemetry. Useful sources include /var/log/kern.log, /var/log/messages, /var/log/syslog, journalctl -k, dmesg archives, kdump/vmcore analysis, pstore entries, and wireless management logs such as hostapd/wpa_supplicant where present. Focus on time-correlated events involving mac80211, cfg80211, DFS, radar detection, CAC cancellation, channel context removal, and kernel slab use-after-free reports. Because this is a kernel memory-safety issue, there may be no clean application-layer IOC; unexplained kernel panics, oopses, KASAN splats, or Wi-Fi driver resets around DFS/radar events are the most useful forensic artifacts. If crash dumps are available, inspect stack traces for ieee80211_dfs_cac_cancel, radar detect work, mac80211 workqueues, and channel context list iteration. Also review wireless event history for suspicious repeated DFS/radar/channel-switch activity that coincides with kernel faults.

• slab-use-after-free
• use-after-free
• KASAN: slab-use-after-free
• BUG: KASAN
• ieee80211_dfs_cac_cancel
• mac80211
• cfg80211
• radar detect
• radar detection
• DFS
• CAC
• channel context
• chanctx
• workqueue
• kernel BUG
• kernel panic
• Oops:
• Call Trace:
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• /sys/fs/pstore/
• /proc/vmcore

What your security team should do

• Inventory Linux laptops, access points, embedded devices, appliances, and servers with active Wi-Fi interfaces, especially those using mac80211/cfg80211 and DFS-capable radios.
• Prioritize patching or vendor firmware updates for systems operating Wi-Fi in untrusted physical spaces or providing AP functionality.
• Verify patched kernels are actually running after update by checking booted kernel version and vendor advisory status.
• Temporarily disable unused wireless interfaces or DFS/AP functionality on systems that cannot be patched promptly.
• Monitor kernel logs and crash telemetry for KASAN, slab-use-after-free, mac80211, DFS, CAC, and ieee80211_dfs_cac_cancel indicators.
• Treat unexplained kernel crashes on Wi-Fi-enabled systems as potentially security-relevant until logs and hardware/driver state are reviewed.
• Track vendor advisories for exact fixed kernel/package versions because fixed versions were not supplied in the input.
• Given the low EPSS score and no known KEV/public exploit status, balance urgency against exposure: prioritize wireless-exposed systems first, then complete routine fleet patching.