CVE-2026-98195

What it actually does

Double deallocation attempt on broadcast stations in the iwlegacy driver due to incomplete clearing of the station 'used' bitmap on the error path of __il4965_up(), leaving IL_STA_BCAST set and allowing __il4965_down() to free the same structures again, resulting in memory corruption.

Why it matters to the business

Linux systems using legacy Intel wireless hardware may experience kernel instability or crashes when RF kill is toggled during driver initialization, increasing downtime risk for affected devices.

How an attack unfolds

An attacker with local access could attempt to trigger the error path by rapidly toggling RF kill during driver load to induce the double-free condition and corrupt kernel memory structures.

How to fix it

Update the Linux kernel to a version containing the fix that clears the entire station 'used' field in il_dealloc_bcast_stations().

How to confirm the fix worked

Verify the kernel source contains the corrected il_dealloc_bcast_stations() implementation that clears the full 'used' bitmap rather than only IL_STA_UCODE_ACTIVE, and test driver startup with RF kill toggling.

Typical attack path

1. Obtain local access to a system with iwlegacy-supported hardware
2. Force driver reload while manipulating RF kill state
3. Trigger repeated up/down cycles to hit the faulty error path
4. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for oops or panic messages referencing il_dealloc_bcast_stations or station bitmap handling during driver initialization; no widespread exploitation artifacts are expected.

What your security team should do

• Apply the upstream kernel fix as soon as a distribution package is available
• Monitor for new kernel releases addressing iwlegacy double-deallocation
• Consider disabling legacy iwlegacy hardware if modern alternatives exist