CVE-2026-98195 (GCVE-0-2026-98195)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of __il4965_up(), il_dealloc_bcast_stations() clears only IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the same broadcast stations to be deallocated again by __il4965_down(). This can occur when RF_KILL is toggled during driver startup. To fix clear the entire 'used' field, since we will not do any other operations on the station.
References
Impacted products
Vendor Product Version
Linux Linux Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlegacy/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "275d474a4b4bd4e73b18b1452f12e78806a8843a",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            },
            {
              "lessThan": "526fdd45548e22eee50ee1062abd88269d9f32e0",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            },
            {
              "lessThan": "c9a116d691364cd7f59d8329b395adcaf826d5c6",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            },
            {
              "lessThan": "85d847ff71fe736cbc15ada321256818e630e205",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            },
            {
              "lessThan": "1d84c2a3de449aceb94ed79eaefecdf1bedb6468",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            },
            {
              "lessThan": "55d34422c0d91436983028fd3c1546a1c2bee55f",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            },
            {
              "lessThan": "a9176fe666af1730cab92350f9c8cf67ebf14439",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            },
            {
              "lessThan": "b5526b780f8b297a76030410b96ba29153afb98f",
              "status": "affected",
              "version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/intel/iwlegacy/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: fix broadcast stations deallocation\n\nOn the error path of __il4965_up(), il_dealloc_bcast_stations() clears\nonly IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the\nsame broadcast stations to be deallocated again by __il4965_down().\n\nThis can occur when RF_KILL is toggled during driver startup.\n\nTo fix clear the entire \u0027used\u0027 field, since we will not do any\nother operations on the station."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:15:26.463Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/275d474a4b4bd4e73b18b1452f12e78806a8843a"
        },
        {
          "url": "https://git.kernel.org/stable/c/526fdd45548e22eee50ee1062abd88269d9f32e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9a116d691364cd7f59d8329b395adcaf826d5c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/85d847ff71fe736cbc15ada321256818e630e205"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d84c2a3de449aceb94ed79eaefecdf1bedb6468"
        },
        {
          "url": "https://git.kernel.org/stable/c/55d34422c0d91436983028fd3c1546a1c2bee55f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9176fe666af1730cab92350f9c8cf67ebf14439"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5526b780f8b297a76030410b96ba29153afb98f"
        }
      ],
      "title": "wifi: iwlegacy: fix broadcast stations deallocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98195",
    "datePublished": "2026-10-06T08:44:34.915Z",
    "dateReserved": "2026-09-25T10:25:14.324Z",
    "dateUpdated": "2026-10-19T09:15:26.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.