CVE-2026-64570 Overview
CVE-2026-64570 is a double-free vulnerability in the Linux kernel's mac80211 wireless subsystem. The flaw resides in the ieee80211_set_fils_discovery() function, which handles Fast Initial Link Setup (FILS) discovery frame templates for Access Point (AP) mode operation. The function calls kfree_rcu() on the old FILS discovery template before allocating its replacement. When the subsequent kzalloc() allocation fails and returns -ENOMEM, the link->u.ap.fils_discovery pointer still references the object already queued for RCU-based freeing. A later update or AP teardown through ieee80211_stop_ap() re-queues the same rcu_head, triggering a second free that KASAN detects during softirq processing of the RCU sheaf.
Critical Impact
The double-free condition in the mac80211 wireless stack can lead to kernel memory corruption, denial of service, or potential privilege escalation on systems operating in AP mode with FILS discovery configured.
Affected Products
- Linux kernel versions containing the ieee80211_set_fils_discovery() implementation in mac80211
- Wireless AP-mode deployments configured with FILS discovery frame templates
- Distributions shipping affected upstream kernels prior to the referenced stable patches
Discovery Timeline
- 2026-08-05 - CVE-2026-64570 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-64570
Vulnerability Analysis
The vulnerability is a Double Free condition within the mac80211 subsystem, which implements the software MAC layer for SoftMAC wireless drivers in the Linux kernel. FILS (Fast Initial Link Setup) discovery is an IEEE 802.11ai feature that reduces association latency by broadcasting compact discovery frames. The ieee80211_set_fils_discovery() function manages the lifecycle of these frame templates when userspace configures or updates AP parameters.
The defect is an ordering error: the previous template is scheduled for RCU-deferred freeing before the new template has been successfully allocated. If allocation subsequently fails, the kernel returns an error without repairing the dangling reference. The stale pointer stored in link->u.ap.fils_discovery continues to reference memory that has already been queued for release.
Root Cause
The root cause is improper resource lifecycle management in the failure path. The function releases the old object using kfree_rcu() before ensuring a valid replacement exists. When kzalloc() returns NULL, link->u.ap.fils_discovery retains the address of the queued object. Any subsequent call that operates on this pointer, such as another configuration update or AP teardown via ieee80211_stop_ap(), invokes kfree_rcu() again on the same rcu_head. The second submission triggers a double-free detected by KASAN inside rcu_free_sheaf during softirq processing of the SLUB cache kmalloc-96.
Attack Vector
Triggering the flaw requires the ability to influence AP configuration and induce an allocation failure in the 96-byte SLUB cache. A local user with CAP_NET_ADMIN capability, or a process able to invoke the nl80211 configuration path, can repeatedly update FILS discovery templates. Under memory pressure, the failing kzalloc() leaves the dangling pointer, and a follow-up update or AP stop triggers the second free. The fix, applied in the referenced stable commits, reorders operations so the old object is queued for kfree_rcu() only after the new template is published, matching the pattern used in ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().
Detection Methods for CVE-2026-64570
Indicators of Compromise
- KASAN kernel log entries reporting BUG: KASAN: double-free in rcu_free_sheaf originating from the SLUB kmalloc-96 cache.
- Kernel oops or panic traces referencing __rcu_free_sheaf_prepare, rcu_free_sheaf, rcu_core, and handle_softirqs on systems running AP mode with FILS discovery.
- Unexpected wireless AP service crashes coinciding with -ENOMEM returns from ieee80211_set_fils_discovery().
Detection Strategies
- Audit installed kernel versions against the fixed commits 1981fba71797, 286e52a799fa, 5baaa1042f71, and e2c55079155a to identify unpatched hosts.
- Enable KASAN or KFENCE on test kernels to surface double-free events in the mac80211 code path during pre-production validation.
- Correlate nl80211 configuration syscalls against kernel warnings on wireless AP hosts.
Monitoring Recommendations
- Ingest dmesg and /var/log/kern.log into centralized log analytics and alert on KASAN, BUG:, and WARNING: strings from softirq contexts.
- Track memory pressure metrics on wireless infrastructure devices to identify conditions favorable to allocation failures.
- Monitor unexpected hostapd restarts or AP interface flaps that may indicate exploitation attempts.
How to Mitigate CVE-2026-64570
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the fix commits to all Linux systems operating in wireless AP mode.
- Prioritize patching for wireless access point appliances, embedded devices, and hotspot infrastructure that expose AP-mode configuration to less-privileged users.
- Restrict access to CAP_NET_ADMIN and nl80211 configuration interfaces to trusted administrative accounts only.
Patch Information
The vulnerability is resolved by reordering the allocation and free sequence so the old template is queued for kfree_rcu() only after the replacement is published. Fix commits are available at the kernel.org stable tree commit 1981fba7, commit 286e52a7, commit 5baaa104, and commit e2c55079.
Workarounds
- Disable FILS discovery in hostapd configuration on affected systems until patches can be deployed.
- Avoid AP-mode deployments on kernels known to be affected, or move AP functionality to patched hosts.
- Limit the ability of unprivileged users and containers to configure wireless interfaces through capability restrictions and seccomp filtering.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
