CVE-2026-64568: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64568 Overview

CVE-2026-64568 is a double-free vulnerability in the Linux kernel's mac80211 wireless subsystem. The flaw resides in ieee80211_set_unsol_bcast_probe_resp(), which handles unsolicited broadcast probe response templates for access points. The function calls kfree_rcu() on the old template before allocating its replacement. When the subsequent kzalloc() fails, the function returns -ENOMEM while link->u.ap.unsol_bcast_probe_resp still references the object already queued for RCU freeing. A later update or AP teardown re-queues the same rcu_head, triggering a second free detected by KASAN during softirq RCU sheaf processing.

Critical Impact
A local attacker who can induce allocation failure during Wi-Fi AP configuration may trigger kernel memory corruption leading to denial of service or potential privilege escalation.

Affected Products

Linux kernel builds containing mac80211 support for unsolicited broadcast probe responses
Systems operating in AP or mesh mode using affected kernel versions
Distributions shipping Linux kernels prior to the fix commits referenced upstream

Discovery Timeline

2026-08-05 - CVE CVE-2026-64568 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64568

Vulnerability Analysis

The vulnerability is a double-free condition [CWE-415] in the Linux kernel mac80211 module. The affected function ieee80211_set_unsol_bcast_probe_resp() manages Wi-Fi broadcast probe response templates for access points. The function freed the existing template through kfree_rcu() prior to allocating its replacement, leaving a dangling pointer in link->u.ap.unsol_bcast_probe_resp if the allocation failed.

KASAN identified the corruption during softirq handling of the RCU sheaf in rcu_free_sheaf at mm/slub.c:5850. The buggy address belonged to the kmalloc-128 cache. Because the same object is re-queued on a subsequent update or AP teardown, the SLUB allocator processes it twice, corrupting the allocator's internal state.

The upstream fix reorders the operations to match ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon(). The old object is queued for kfree_rcu() only after the replacement has been published, eliminating the window in which a failed allocation leaves a dangling pointer.

Root Cause

The root cause is incorrect ordering of free and allocation operations. kfree_rcu() is invoked on the old template before the replacement allocation succeeds. When kzalloc() returns NULL, the pointer to the already-queued object remains reachable through link->u.ap.unsol_bcast_probe_resp.

Attack Vector

Triggering the flaw requires forcing an allocation failure inside ieee80211_set_unsol_bcast_probe_resp() and then invoking a subsequent update or AP teardown. A local user with the ability to configure wireless interfaces, or an attacker leveraging memory pressure conditions, can reach the vulnerable path. The exact impact depends on adjacent SLUB objects and heap layout at the time of the second free.

No public proof-of-concept exploit code is available. The vulnerability is described in the upstream kernel commits referenced below and the KASAN report included in the patch description.

Detection Methods for CVE-2026-64568

Indicators of Compromise

KASAN reports containing BUG: KASAN: double-free in rcu_free_sheaf with call traces referencing __rcu_free_sheaf_prepare and rcu_core
Kernel panics or oops messages originating from softirq context involving the kmalloc-128 cache
Unexpected AP interface teardown failures on systems configured with unsolicited broadcast probe responses

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for KASAN double-free signatures involving mac80211 code paths
Compare running kernel versions against the upstream fix commits (0ace76e4, 1d067abc, ca27a81c, d62b55b7)
Track configuration changes to wireless interfaces in AP mode through audit logging

Monitoring Recommendations

Enable KASAN on test and staging systems to surface memory corruption early
Aggregate kernel crash telemetry from endpoints running AP or hotspot workloads
Alert on repeated nl80211 or hostapd operations that precede kernel crash events

How to Mitigate CVE-2026-64568

Immediate Actions Required

Apply the upstream Linux kernel patches from the referenced stable branches as soon as vendor builds become available
Restrict access to wireless configuration commands (iw, hostapd, nl80211) to trusted administrators only
Disable unsolicited broadcast probe response templates on affected APs if the feature is not required

Patch Information

The fix reorders operations so that kfree_rcu() is queued only after the replacement template is published. The upstream commits addressing this issue are 0ace76e4, 1d067abc, ca27a81c, and d62b55b7. Consumers should apply distribution updates that incorporate these commits.

Workarounds

Avoid enabling unsolicited broadcast probe responses in hostapd configurations on unpatched kernels
Limit the ability of unprivileged users to configure wireless interfaces through capability restrictions (CAP_NET_ADMIN)
Reduce memory pressure on affected hosts to lower the probability of triggering the allocation failure path

bash

# Verify kernel version and check for the mac80211 fix
uname -r
# Confirm hostapd configuration does not enable unsolicited probe responses
grep -i unsol_bcast_probe_resp /etc/hostapd/hostapd.conf