CVE-2026-46125: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46125 Overview

CVE-2026-46125 is a use-after-free and double-free vulnerability in the Linux kernel's mac80211 wireless subsystem. The flaw resides in the handling of Multi-Link Operation (MLO) connections used by Wi-Fi 7 devices. When connection preparation fails for an MLO connection, the kernel resets the interface to non-MLD mode but fails to remove an associated station entry tied to the link of the virtual interface (vif) being torn down.

The defect triggers a use-after-free or double-free in debugfs when that subsystem is enabled, because transitioning a vif between MLD states recreates its entire debugfs hierarchy.

Critical Impact
A failed MLO connection attempt can corrupt kernel memory through stale station references, potentially leading to kernel crashes or memory corruption on affected Wi-Fi 7 capable Linux systems.

Affected Products

Linux kernel mac80211 subsystem (wireless stack)
Systems with CONFIG_MAC80211_DEBUGFS enabled
Wi-Fi 7 capable devices using MLO connections on Linux

Discovery Timeline

2026-05-28 - CVE-2026-46125 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46125

Vulnerability Analysis

The vulnerability lives in the Linux kernel mac80211 layer, which implements the soft-MAC functions of the Wi-Fi stack. MLO is a Wi-Fi 7 feature that allows a station to maintain multiple simultaneous links to an access point. When mac80211 attempts to bring up an MLO connection and preparation fails, the driver collapses the interface back to a single-link, non-MLD configuration.

During this teardown, the existing station object remains attached to a link of the vif that is being removed. The station outlives the structures it references. Because debugfs entries for the vif are destroyed and recreated whenever a vif transitions between MLD and non-MLD modes, the dangling station's debugfs files reference freed memory, producing a use-after-free or, on subsequent cleanup, a double-free.

Root Cause

The root cause is missing lifecycle management for the existing station on the MLO-to-non-MLD failure path. The patch removes the existing station when connection preparation fails. Any pending new_sta is already removed by the existing error path, so only the established station required additional handling. The bug is classified under memory safety errors involving Use-After-Free and Double-Free conditions.

Attack Vector

Triggering the flaw requires conditions that cause MLO connection preparation to fail after a station object has been created. An attacker capable of influencing the wireless association process — for example, a hostile or misconfigured access point in radio range — can repeatedly induce failed MLO setups. With debugfs enabled, the resulting dangling station references can be exercised through normal debugfs access, producing kernel memory corruption or panics.

No verified public exploit code is available for this issue. Technical details are documented in the upstream fix commits referenced below.

Detection Methods for CVE-2026-46125

Indicators of Compromise

Kernel oops or panic messages referencing ieee80211_, sta_info, or debugfs functions in mac80211.
KASAN reports indicating use-after-free or double-free in mac80211 station or debugfs paths.
Repeated MLO association failures followed by kernel instability on Wi-Fi 7 capable hosts.

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free conditions in mac80211 during MLO association testing.
Monitor dmesg and journald for mac80211 warnings, BUG splats, and debugfs related stack traces.
Inventory kernel versions across Linux fleets and flag hosts running unpatched mac80211 variants on Wi-Fi 7 hardware.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG:, KASAN, and general protection fault entries originating in wireless subsystems.
Track wireless association failure rates per endpoint to identify abnormal MLO failure patterns indicative of a hostile access point.
Correlate wireless events with endpoint stability metrics to detect post-association crashes.

How to Mitigate CVE-2026-46125

Immediate Actions Required

Apply the upstream mac80211 fix by updating to a kernel build that includes the referenced stable commits.
For systems that cannot be patched immediately, disable CONFIG_MAC80211_DEBUGFS in custom kernel builds to eliminate the use-after-free trigger path.
Restrict the wireless attack surface by limiting which networks managed endpoints may associate with, particularly on Wi-Fi 7 capable hardware.

Patch Information

The issue is resolved in upstream Linux through the following commits. Distribution kernels should pick up the corresponding backports:

The fix deletes the existing station on the MLO connection-prep failure path, preventing the stale link reference that leads to debugfs memory corruption.

Workarounds

Disable mac80211debugfs support at build time by unsetting CONFIG_MAC80211_DEBUGFS until patched kernels are deployed.
Restrict access to /sys/kernel/debug so only privileged users can interact with debugfs entries.
Where MLO is not required, force clients to associate using single-link mode to avoid the affected code path.

bash

# Restrict debugfs access and verify mac80211 debugfs state
mount -o remount,mode=700 /sys/kernel/debug
grep CONFIG_MAC80211_DEBUGFS /boot/config-$(uname -r)

# Confirm running kernel version after patching
uname -r