Cloudanix VulnDB

CVE-2026-98708

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles WiFi network channel changes can let attackers crash computers or gain extra access on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in mac80211 channel context replacement where the old WILL_BE_REPLACED chanctx is freed while a reciprocal replace_ctx pointer from the new context still references it, allowing later unreserve or switch paths to dereference the stale pointer.

Why it matters to the business

Kernel instability or potential code execution on Linux WiFi systems can lead to system crashes, denial of service, or elevated privileges for local attackers, increasing downtime and security risk for any device relying on the affected wireless stack.

How an attack unfolds

An attacker with local access triggers repeated channel context assignment, release, and re-assignment operations that cause the kernel to free the old context while the replacement pairing remains intact; subsequent unreserve or finalization code then follows the dangling replace_ctx pointer to achieve memory corruption.

How to fix it

Update the Linux kernel to a version containing the fix that keeps the paired old chanctx alive until the replacement pair is torn down; apply the same lifetime check in __ieee80211_link_release_channel and ieee80211_link_use_reserved_reassign; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the kernel source contains the updated lifetime checks in the cited functions and that no early-free paths bypass the replacement-pair guard; test by exercising link release and reassign operations under concurrent channel context changes.

Typical attack path

  1. Obtain local execution on a Linux system with mac80211 WiFi
  2. Manipulate wireless interface to force chanctx allocation and in-place replacement
  3. Release the last assigned link or reassign it to trigger early free of the paired old context
  4. Execute unreserve or switch-finalization paths that dereference the stale replace_ctx pointer
  5. Achieve use-after-free memory corruption for crash or further exploitation

How to detect it

Inspect kernel logs for oops or panic messages referencing mac80211 chanctx, replace_ctx, or ieee80211_link functions around the time of WiFi interface changes; correlate with wireless configuration events that trigger channel context reassignment.

What your security team should do

  • Prioritize kernel updates for all Linux WiFi endpoints within the next maintenance window
  • Monitor upstream stable branches for backported fixes to the mac80211 chanctx handling
  • Restrict local user access on multi-user systems until patches are deployed
  • Review wireless driver usage in embedded or appliance deployments for exposure

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider assigned and reserved link users when deciding whether to free the old chanctx. That lets the old chanctx be freed too early while the replacement partner still points back to it, either when the last assigned link is released or when that link successfully reassigns to another existing context. Later unreserve and switch-finalization paths can then follow a stale replace_ctx pointer. Keep a paired old chanctx alive until the replacement pair has been torn down. Apply the same check to both __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign(). If the replacement is later abandoned, ieee80211_link_unreserve_chanctx() already tears down the pairing before freeing the old chanctx once no users remain.

Affected packages

Ecosystem Package Introduced Fixed