CVE-2026-98709wifi: mac80211: count only matching reservations in reserved switch
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation. That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation. Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before d31f655e44631891788ca67018ec5e1ed1c7de86; from 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before 03525b632908b049f4d04cc8a71cdff2329589cf; from 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before 5cc54a000960bc88f8c58940164dca0e601ab39c; from 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f before 437f3727b4fd715266c296435c116288f82666fd | CNA record |
References
- https://git.kernel.org/stable/c/d31f655e44631891788ca67018ec5e1ed1c7de86
- https://git.kernel.org/stable/c/03525b632908b049f4d04cc8a71cdff2329589cf
- https://git.kernel.org/stable/c/5cc54a000960bc88f8c58940164dca0e601ab39c
- https://git.kernel.org/stable/c/437f3727b4fd715266c296435c116288f82666fd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.