CVE-2026-98709 (GCVE-0-2026-98709)
Vulnerability from cvelistv5
Published
2026-10-18 15:46
Modified
2026-10-30 12:39
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation. That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation. Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
Version: 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/chan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c4671a706d2d85442a30850abfada5377ffbbc8",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            },
            {
              "lessThan": "183cc72ae9467717afba8b8d194a558a6666cb53",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            },
            {
              "lessThan": "b3d9f582f98e06070d5233b177b2899b693a01ec",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            },
            {
              "lessThan": "4ae6ed5b6074df5f3da05fd74c40bb24c5c9b41d",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            },
            {
              "lessThan": "d31f655e44631891788ca67018ec5e1ed1c7de86",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            },
            {
              "lessThan": "03525b632908b049f4d04cc8a71cdff2329589cf",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            },
            {
              "lessThan": "5cc54a000960bc88f8c58940164dca0e601ab39c",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            },
            {
              "lessThan": "437f3727b4fd715266c296435c116288f82666fd",
              "status": "affected",
              "version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/chan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.273",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.224",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: count only matching reservations in reserved switch\n\nieee80211_vif_use_reserved_switch() validates a replacement by counting\nassigned links on ctx-\u003ereplace_ctx and treating reservations too\nbroadly. A link can still be assigned to the old channel context while\nholding a reservation that belongs to a different replacement\noperation.\n\nThat can make the current replacement appear complete too early. If\nanother link finalizes first, the function can free the\nWILL_BE_REPLACED chanctx while the unmatched link and driver still use\nit, leading to a use-after-free in later beacon generation.\n\nRequire an in-place reservation to point at the current replacement\ncontext, and require the reserved and assigned contexts to be the\nmatching replacement pair, before counting or moving the link."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:39:00.231Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c4671a706d2d85442a30850abfada5377ffbbc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/183cc72ae9467717afba8b8d194a558a6666cb53"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3d9f582f98e06070d5233b177b2899b693a01ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ae6ed5b6074df5f3da05fd74c40bb24c5c9b41d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d31f655e44631891788ca67018ec5e1ed1c7de86"
        },
        {
          "url": "https://git.kernel.org/stable/c/03525b632908b049f4d04cc8a71cdff2329589cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cc54a000960bc88f8c58940164dca0e601ab39c"
        },
        {
          "url": "https://git.kernel.org/stable/c/437f3727b4fd715266c296435c116288f82666fd"
        }
      ],
      "title": "wifi: mac80211: count only matching reservations in reserved switch",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98709",
    "datePublished": "2026-10-18T15:46:39.290Z",
    "dateReserved": "2026-09-25T10:25:14.365Z",
    "dateUpdated": "2026-10-30T12:39:00.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.