CVE-2026-23185: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23185 Overview

A use-after-free vulnerability has been identified in the Linux kernel's iwlwifi wireless driver, specifically within the Multi-Link Device (MLD) scanning functionality. The mlo_scan_start_wk work queue is not properly canceled on disconnection, which can lead to critical memory corruption issues including use-after-free and init-after-queue conditions.

Critical Impact

This vulnerability can cause kernel crashes and potential code execution through use-after-free conditions when the wireless work queue is executed after the virtual interface (vif) has been freed or reinitialized.

Affected Products

• Linux kernel with iwlwifi MLD driver support
• Systems using Intel wireless adapters with Multi-Link Operation capabilities
• Linux distributions with vulnerable kernel versions

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23185 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23185

Vulnerability Analysis

This vulnerability exists in the Intel iwlwifi wireless driver's Multi-Link Device (MLD) implementation. The core issue is improper lifecycle management of the mlo_scan_start_wk work queue item. When a wireless disconnection occurs, the driver fails to cancel this pending work, leaving it queued for execution even after the associated virtual interface (vif) may have been freed or modified.

The vulnerability can manifest in two critical scenarios. First, an init-after-queue issue can occur when the work queue was scheduled and then drv_change_interface gets executed, leading to operations being performed on an uninitialized or incorrectly initialized interface. Second, and more critically, a use-after-free condition can occur if the work queue executes after the vif structure has been freed, potentially allowing an attacker to corrupt kernel memory or execute arbitrary code.

Root Cause

The root cause is missing work queue cancellation logic in the iwlwifi MLD driver's disconnection handler. While the mlo_scan_start_wk work is canceled during restart cleanup, this cancellation is not performed during normal disconnection events, leaving stale work items in the queue that reference potentially freed memory structures.

Attack Vector

The attack vector requires local access to a system with an Intel wireless adapter supporting Multi-Link Operation. An attacker would need to trigger a disconnection event while the MLO scan work is pending, then cause the vif to be freed before the work queue processes the stale entry. This could be achieved through rapid wireless state transitions or by manipulating the driver state through standard wireless configuration interfaces.

The exploitation relies on timing-dependent memory corruption through the use-after-free condition, where the freed vif structure memory could be reallocated and controlled by an attacker before the stale work queue entry references it.

Detection Methods for CVE-2026-23185

Indicators of Compromise

• Kernel panic or oops messages referencing iwlwifi, mld, or MLO scan functions
• Unexpected wireless disconnection patterns followed by system instability
• Memory corruption warnings in kernel logs related to wireless subsystem
• Crash dumps showing stack traces in iwlwifi driver code paths

Detection Strategies

• Monitor kernel logs for use-after-free detection messages from KASAN (if enabled)
• Watch for iwlwifi driver crashes or unexpected behavior during wireless state transitions
• Implement kernel oops/panic monitoring for production systems
• Review dmesg output for iwlwifi warnings related to work queue handling

Monitoring Recommendations

• Enable KASAN (Kernel Address Sanitizer) on development and test systems to detect memory corruption
• Configure kernel crash dump collection to capture debugging information
• Monitor wireless interface stability metrics for anomalous disconnection patterns
• Implement centralized logging for kernel messages across affected systems

How to Mitigate CVE-2026-23185

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix
• Review kernel changelogs for the specific patch commits
• Test updated kernels in staging environments before production deployment
• Consider temporarily disabling Multi-Link Operation features if patches cannot be immediately applied

Patch Information

The Linux kernel developers have released patches to address this vulnerability. The fix ensures that mlo_scan_start_wk is properly canceled during disconnection events, preventing the work queue from executing with stale references.

Relevant patch commits are available:

• Kernel Security Patch (commit 5ff641011ab7fb63ea101251087745d9826e8ef5)
• Kernel Stability Commit (commit 9b9f52f052f4953fecd2190ae2dde3aa76d10962)

Workarounds

• Disable Multi-Link Operation (MLO) features in wireless configuration if supported by your driver version
• Avoid rapid wireless state transitions that could trigger the race condition
• Monitor for kernel crashes and implement automatic recovery mechanisms
• Consider using alternative wireless drivers if available for your hardware

# Check current kernel version and iwlwifi module status
uname -r
lsmod | grep iwlwifi

# View iwlwifi driver messages for debugging
dmesg | grep -i iwlwifi

# Update kernel packages (Debian/Ubuntu)
sudo apt update && sudo apt upgrade linux-image-generic

# Update kernel packages (RHEL/CentOS/Fedora)
sudo dnf update kernel