CVE-2026-64117: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64117 Overview

CVE-2026-64117 is a use-after-free vulnerability in the Linux kernel's mac80211 wireless subsystem. The flaw resides in the mesh unicast forward path, where ieee80211_invoke_fast_rx() reads RX status via IEEE80211_SKB_RXCB(skb). That storage aliases skb->cb, which ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. When mesh forwarding either queues the skb for TX or frees it on the no-route path, the caller later invokes sta_stats_encode_rate(status) on memory that has been zeroed or freed. The result is a KASAN-detected slab-use-after-free in ieee80211_prepare_and_rx_handle.

Critical Impact
An attacker within Wi-Fi range of a Linux mesh node can trigger a kernel use-after-free through crafted 802.11s mesh frames, enabling denial of service and potential kernel memory corruption.

Affected Products

Linux kernel builds with CONFIG_MAC80211 and 802.11s mesh networking enabled
Wireless drivers relying on the mac80211 fast-RX path
Distributions shipping pre-patch stable kernels prior to the referenced commits

Discovery Timeline

2026-07-19 - CVE-2026-64117 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64117

Vulnerability Analysis

The vulnerability originates in the interaction between the mac80211 fast-RX path and mesh forwarding logic. skb->cb is a scratch control block used by the Linux networking stack for per-skb metadata. The mac80211 stack aliases this region for two mutually exclusive purposes: RX status (IEEE80211_SKB_RXCB) and TX metadata (IEEE80211_SKB_CB / IEEE80211_TX_INFO).

During mesh unicast forwarding, ieee80211_rx_mesh_data() performs info = IEEE80211_SKB_CB(fwd_skb); memset(info, 0, sizeof(*info)); on the same skb the caller still references via rx->skb. The function then either enqueues the skb for TX or calls kfree_skb() when no route exists, and returns RX_QUEUED.

The caller's RX_QUEUED branch subsequently invokes sta_stats_encode_rate(status) on a pointer that now targets either zeroed TX metadata or freed slab memory. KASAN flags this as a slab-use-after-free inside ieee80211_prepare_and_rx_handle.

Root Cause

The root cause is a lifetime and aliasing violation of the skb->cb control block. RX status is consumed after the same storage is repurposed or the skb is released, so the caller reads stale or freed data.

Attack Vector

Exploitation requires adjacent-network access to a Linux node participating in an 802.11s mesh. An attacker transmits crafted mesh unicast frames whose destination triggers the forwarding path with no valid route, causing kfree_skb() and subsequent access to freed memory during rate encoding.

No verified public exploit or proof-of-concept code is available. See the upstream fix commit 2fb64f94 and stable backport d71c841b for the corrected ordering.

Detection Methods for CVE-2026-64117

Indicators of Compromise

KASAN reports naming slab-use-after-free in ieee80211_prepare_and_rx_handle or sta_stats_encode_rate in kernel logs
Unexpected kernel oopses or panics on mesh-capable wireless interfaces
Repeated crashes correlated with 802.11s mesh peer activity from a specific MAC address

Detection Strategies

Enable KASAN on test kernels to surface use-after-free conditions in the mac80211 mesh path
Monitor dmesg and /var/log/kern.log for stack traces referencing ieee80211_rx_mesh_data or ieee80211_invoke_fast_rx
Correlate wireless interface resets or driver reloads with proximity of untrusted mesh peers

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on mac80211 fault signatures
Track kernel package versions across Linux fleets to identify unpatched hosts running mesh workloads
Baseline wireless mesh peer counts and flag anomalous peer churn on production nodes

How to Mitigate CVE-2026-64117

Immediate Actions Required

Apply the stable kernel updates containing commits 2fb64f94f9af and d71c841be5d9 as soon as vendor packages are available
Inventory all Linux systems using mac80211 with 802.11s mesh enabled and prioritize those exposed to untrusted wireless environments
Restart affected systems after patching to ensure the vulnerable kernel image is unloaded

Patch Information

The upstream fix reorders the code so that the RX rate is encoded from status before ieee80211_rx_mesh_data() is called. The RX_QUEUED arm then consumes a value captured while status was still backed by valid memory. Patches are available in the mainline commit and the stable branch backport.

Workarounds

Disable 802.11s mesh mode on wireless interfaces where mesh forwarding is not required
Unload the affected wireless driver and mac80211 module on systems that do not need Wi-Fi
Restrict mesh peering to authenticated peers using SAE and Mesh Peering Management where mesh is required

bash

# Identify mesh interfaces and disable them if not required
iw dev
sudo iw dev <mesh_iface> del

# Prevent mac80211 from loading on systems that do not need Wi-Fi
echo 'blacklist mac80211' | sudo tee /etc/modprobe.d/blacklist-mac80211.conf
sudo update-initramfs -u