Cloudanix VulnDB

CVE-2026-98704

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux wireless code could let attackers crash devices or run harmful code by setting up fake WiFi networks that devices try to join.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel mac80211 ieee80211_assoc_config_link when copying element pointers from a freed fallback parse object for non-transmitted MBSSID profiles, allowing reads of freed memory during operating channel determination and HT/VHT capability application.

Why it matters to the business

Wireless connectivity on Linux systems may become unstable or lead to crashes, with potential for remote code execution, affecting device availability and increasing exposure on networks using MBSSID configurations.

How an attack unfolds

An attacker deploys a rogue access point advertising non-transmitted MBSSID profiles and sends an association response that omits WMM, HT, or VHT elements, causing the kernel to parse cached BSS IEs, free the fallback object, and later dereference the dangling pointers.

How to fix it

Apply the upstream Linux kernel patch that keeps the fallback parse result alive until association setup finishes; rebuild and deploy updated kernels to affected systems.

How to confirm the fix worked

Confirm the reorder of variable declaration and retention of the fallback parse object in mac80211 source; test association flows against non-transmitted MBSSID profiles in a lab environment.

Typical attack path

  1. Deploy rogue AP configured with non-transmitted MBSSID
  2. Transmit association response omitting required information elements
  3. Trigger ieee80211_assoc_config_link fallback parsing path
  4. Force use of pointers after parse object is freed
  5. Achieve memory corruption during channel and capability setup

How to detect it

Search kernel logs and dmesg for mac80211 association failures or crashes referencing MBSSID or BSS IE parsing; correlate with recent wireless connection attempts.

What your security team should do

  • Prioritize kernel updates on wireless Linux endpoints within the next patching cycle
  • Review wireless configurations to limit MBSSID usage until patched
  • Monitor kernel logs for mac80211 association errors

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits WMM, HT, or VHT information, ieee80211_assoc_config_link() parses the cached BSS IEs and copies the missing element pointers out of that fallback parse. For a non-transmitted MBSSID profile those pointers refer to merged-profile storage owned by the parse object, and the fallback block frees that object at its end. The copied pointers are used afterwards to determine the operating channel, configure bandwidth, and apply HT capabilities. Keep the fallback parse result alive until association setup finishes. [reorder variable declaration]

Affected packages

Ecosystem Package Introduced Fixed