CVE-2026-98709

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation. That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation. Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-18 16:17:24.437000

Last modified

2026-10-30 13:21:20.337000

View original CVE JSON

{
  "id": "CVE-2026-98709",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-18T16:17:24.437",
  "lastModified": "2026-10-30T13:21:20.337",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: count only matching reservations in reserved switch\n\nieee80211_vif_use_reserved_switch() validates a replacement by counting\nassigned links on ctx->replace_ctx and treating reservations too\nbroadly. A link can still be assigned to the old channel context while\nholding a reservation that belongs to a different replacement\noperation.\n\nThat can make the current replacement appear complete too early. If\nanother link finalizes first, the function can free the\nWILL_BE_REPLACED chanctx while the unmatched link and driver still use\nit, leading to a use-after-free in later beacon generation.\n\nRequire an in-place reservation to point at the current replacement\ncontext, and require the reserved and assigned contexts to be the\nmatching replacement pair, before counting or moving the link."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/mac80211/chan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "4c4671a706d2d85442a30850abfada5377ffbbc8",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "183cc72ae9467717afba8b8d194a558a6666cb53",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "b3d9f582f98e06070d5233b177b2899b693a01ec",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "4ae6ed5b6074df5f3da05fd74c40bb24c5c9b41d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "d31f655e44631891788ca67018ec5e1ed1c7de86",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "03525b632908b049f4d04cc8a71cdff2329589cf",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "5cc54a000960bc88f8c58940164dca0e601ab39c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "lessThan": "437f3727b4fd715266c296435c116288f82666fd",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/mac80211/chan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.17",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.17",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.273",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.224",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.113",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.56",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.10",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/03525b632908b049f4d04cc8a71cdff2329589cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/183cc72ae9467717afba8b8d194a558a6666cb53",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/437f3727b4fd715266c296435c116288f82666fd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4ae6ed5b6074df5f3da05fd74c40bb24c5c9b41d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4c4671a706d2d85442a30850abfada5377ffbbc8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5cc54a000960bc88f8c58940164dca0e601ab39c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b3d9f582f98e06070d5233b177b2899b693a01ec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d31f655e44631891788ca67018ec5e1ed1c7de86",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}