Cloudanix VulnDB

CVE-2026-98341

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's wireless networking code can let a local user crash the system or run code they should not be able to by manipulating wireless scans when a network connection is turned off.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel cfg80211 when an interface is taken down during an active scan: the driver retains ownership of the scan request while cfg80211 frees it, resulting in a subsequent free in scan_done() on the already-freed object.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, privilege escalation, or arbitrary code execution; the flaw affects wireless-enabled devices and requires a kernel update to resolve.

How an attack unfolds

An attacker with local access brings a wireless interface down while a scan request is in flight; cfg80211 completes and frees the request toward userspace, but the driver still believes it owns the request and later performs operations on the freed object in scan_done(), causing the UAF.

How to fix it

Upgrade to a Linux kernel containing the fix that tracks driver-owned scan requests and avoids the double-free path; apply the patch that removes the problematic WARN_ON and handles already-cancelled requests on completion.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds tracking for driver-owned scan requests and removes the netdev notifier WARN_ON; verify no UAF reports appear in dmesg when interfaces are downed during scans.

Typical attack path

  1. Obtain local access to a Linux system with wireless networking enabled
  2. Trigger or wait for an active cfg80211 scan request
  3. Bring the wireless interface down (e.g., via ifconfig down or equivalent)
  4. Force cfg80211 to complete the scan and free the request while the driver still holds a reference
  5. Trigger the driver's scan completion path to dereference the freed object

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for messages referencing cfg80211 scan_done, netdev notifier warnings, or use-after-free faults involving scan requests; look for unexpected interface-down events coinciding with scan activity.

  • cfg80211.*scan_done
  • netdev notifier.*WARN_ON
  • UAF.*scan request
  • driver-owned scan request

What your security team should do

  • Prioritize kernel updates on all wireless-enabled Linux hosts within the next patch cycle
  • Monitor kernel logs for scan-related warnings or use-after-free crashes on systems that cannot be immediately updated
  • Restrict local user access on high-risk endpoints until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it owns the request, since the cancellation is (intended to be) asynchronous. The WARN_ON() in the netdev notifier was meant to catch this, but it's not actually avoidable, so it triggers and we get a UAF in scan_done(). There doesn't seem to be a great way around it, so just track that the driver is still convinced it owns the request, and then just free it on completion if it was already cancelled. Also remove the warnings since they can trigger in the intended architecture.

Affected packages

Ecosystem Package Introduced Fixed