Cloudanix VulnDB

CVE-2026-98823

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux handles certain wireless network scan results could let an attacker crash the system or potentially run code with high privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in cfg80211 when cfg80211_update_assoc_bss_entry passes a hidden-group probe-response entry (that borrows beacon_ies) to cfg80211_update_known_bss during post-channel-switch scan merging; the subsequent copy creates dual owners of the same allocation so that freeing the group beacon entry leaves a dangling pointer that is freed again.

Why it matters to the business

Kernel memory corruption on Linux Wi-Fi devices can cause crashes, denial of service, or potential privilege escalation when systems perform wireless scans after channel switches near hidden-SSID networks.

How an attack unfolds

An attacker crafts or positions hidden-SSID access points, forces a victim Linux station to perform scans and channel switches, and triggers the cfg80211 BSS entry merge path so that the double-owned beacon_ies allocation is released twice.

How to fix it

Apply the upstream patch that skips beacon IE replacement when the source entry belongs to a hidden group; rebuild and deploy the fixed kernel. Monitor stable branches for the commit that preserves hidden-group beacon IE ownership.

How to confirm the fix worked

Confirm the patch is present by inspecting the cfg80211_update_known_bss logic for the hidden-group check; run wireless scan and channel-switch test cases that previously reproduced the double-free.

Typical attack path

  1. Position hidden-group APs that trigger borrowed beacon_ies entries
  2. Induce channel switch on victim station
  3. Force scan-result merging via cfg80211_update_assoc_bss_entry
  4. Trigger release of the group beacon entry followed by release of the associated entry
  5. Trigger second free of the now-dangling beacon_ies buffer

How to detect it

Review kernel crash logs and slab allocator reports for double-free signatures involving cfg80211 beacon_ies allocations during BSS updates; correlate with wireless scan activity preceding the crash.

What your security team should do

  • Prioritize kernel updates on all Linux Wi-Fi endpoints within normal patch cycles
  • Monitor EPSS and KEV feeds for any future increase in exploit maturity
  • Add kernel memory-corruption telemetry to existing crash-reporting pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211_update_assoc_bss_entry() can pass such an entry to cfg80211_update_known_bss() when merging scan entries after a channel switch. Copying the borrowed beacon_ies into the associated entry gives the same allocation two owners. Releasing the group's beacon entry can then leave the associated entry pointing to freed IEs, which are freed again when that entry is released. Skip beacon IE replacement when the source entry belongs to a hidden group. Preserve probe-response processing, the subsequent metadata updates, and the existing rejection path for conflicting hidden beacon updates.

Affected packages

Ecosystem Package Introduced Fixed