CVE-2026-98709

What it actually does

Incorrect reservation counting in ieee80211_vif_use_reserved_switch allows a WILL_BE_REPLACED channel context to be freed while still referenced by an unmatched link and driver structures, resulting in use-after-free during subsequent beacon generation.

Why it matters to the business

Systems running affected Linux kernels with mac80211 Wi-Fi may experience crashes or arbitrary code execution in kernel context when Wi-Fi channel context replacements occur, potentially leading to loss of wireless connectivity or full system compromise on affected devices.

How an attack unfolds

An attacker with the ability to trigger Wi-Fi channel context switches (via crafted management frames or local interface manipulation) causes mismatched reservations so that the replacement logic frees an active context; a subsequent beacon generation then dereferences the freed memory, enabling control-flow hijacking.

How to fix it

Upgrade to a Linux kernel containing the fix that requires reservations to point at the current replacement context and verifies matching reserved/assigned pairs before counting links. Apply the patch referenced in the commit that enforces these checks.

How to confirm the fix worked

Confirm the presence of the corrected ieee80211_vif_use_reserved_switch logic that validates replacement context pointers and matching pairs; test channel-context switch paths under load and verify no use-after-free reports in kernel logs or with KASAN-enabled builds.

Typical attack path

1. Obtain local or adjacent network access to a system using mac80211 Wi-Fi.
2. Trigger repeated channel context replacement operations through crafted 802.11 frames or interface reconfiguration.
3. Force a mismatched reservation state that causes ieee80211_vif_use_reserved_switch to free the context prematurely.
4. Trigger beacon generation on the still-referenced freed context to achieve use-after-free.
5. Leverage the resulting kernel memory corruption for privilege escalation or denial of service.

How to detect it

Review kernel logs for use-after-free warnings or KASAN reports involving mac80211 channel contexts or beacon generation; correlate with Wi-Fi interface state changes and channel switches in dmesg or audit logs.

What your security team should do

• Prioritize kernel updates on all Wi-Fi-enabled Linux systems within the next maintenance window.
• Monitor upstream stable and distribution kernel changelogs for the specific mac80211 reservation fix.
• Restrict unprivileged local access and Wi-Fi interface control where feasible until patched.
• Enable kernel hardening features such as KASAN or hardened allocators on test systems to detect similar issues.