CVE-2026-64574: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64574 Overview

CVE-2026-64574 is a use-after-free vulnerability in the Linux kernel's mac80211 wireless subsystem. The flaw resides in ieee80211_vif_update_links(), which handles Multi-Link Operation (MLO) link updates for virtual interfaces. When drv_change_vif_links() fails after new links have been allocated, the error path frees the link containers without removing their associated debugfs entries or stopping the links. A subsequent open() and read() on a per-link debugfs file such as link-1/txpower dereferences the freed container through a dangling file->private_data pointer.

Critical Impact
A local attacker who can trigger MLO link update failures can read freed kernel memory via debugfs, leading to information disclosure or a kernel panic through ieee80211_if_read_link().

Affected Products

Linux kernel versions containing the mac80211 MLO link update code path prior to the referenced fix commits
Distributions shipping stable kernels with wifi: mac80211 MLO support
Systems using wireless drivers that implement drv_change_vif_links() and can fail at runtime

Discovery Timeline

2026-08-05 - CVE-2026-64574 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64574

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] triggered through the mac80211 debugfs interface. When ieee80211_vif_update_links() adds new links, it allocates a link container for each and invokes ieee80211_link_init(). This registration step creates per-link debugfs files whose file->private_data points into the link container. It then calls ieee80211_link_setup() to complete initialization.

If the subsequent call to drv_change_vif_links() fails, the error path restores old pointers and jumps to the free label. That label releases the newly allocated containers but never unregisters the debugfs entries or calls ieee80211_link_stop(). The debugfs files remain visible on the filesystem with private_data referencing freed memory.

A later open() followed by read() on a file such as link-1/txpower reaches ieee80211_if_read_link() in net/mac80211/debugfs_netdev.c, which dereferences the dangling pointer. The KASAN report confirms a slab-use-after-free read of 8 bytes, and the resulting general protection fault triggers a kernel panic.

Root Cause

The removal path already dismantles links correctly through ieee80211_tear_down_links(), which removes each link's keys and debugfs entries and calls ieee80211_link_stop(). The add path's error branch was never updated to perform equivalent teardown. Commit be1ba9ed221f previously hardened this error path for the link-removal case where new_links == 0, but the newly added links case remained unaddressed.

Attack Vector

drv_change_vif_links() can fail at runtime on MLO drivers due to internal allocation failures, queue errors, or firmware command failures. A local user with access to the wireless interface configuration and debugfs can induce a link update failure and then read the stale debugfs file, dereferencing freed slab memory in kernel context.

No verified public exploit code is available. Refer to the upstream fix commits including Kernel Git Commit 0f7eaeb and Kernel Git Commit c57d97f for the corrected teardown logic.

Detection Methods for CVE-2026-64574

Indicators of Compromise

KASAN reports of slab-use-after-free in ieee80211_if_read_link in kernel logs
Kernel general protection faults referencing non-canonical addresses within net/mac80211/debugfs_netdev.c
Unexpected kernel panics correlated with wireless MLO reconfiguration events
Repeated reads of /sys/kernel/debug/ieee80211/*/netdev:*/link-*/ files by non-root or untrusted processes

Detection Strategies

Monitor dmesg and journald for KASAN diagnostics referencing ieee80211_if_read_link or ieee80211_vif_update_links
Audit access patterns to mac80211 debugfs paths under /sys/kernel/debug/ieee80211/
Flag processes that trigger nl80211 link add or update commands followed by debugfs reads on freshly created link directories

Monitoring Recommendations

Collect kernel crash reports and correlate them with wireless driver error returns from drv_change_vif_links()
Enable auditd rules on debugfs mounts to record read syscalls against link-* files
Restrict mount visibility of debugfs to root-only and alert on any change to its permissions

How to Mitigate CVE-2026-64574

Immediate Actions Required

Apply the upstream mac80211 fix commits that add teardown of new links on the ieee80211_vif_update_links() error path
Restrict access to /sys/kernel/debug so only privileged users can open per-link debugfs files
Update to the latest stable Linux kernel release from your distribution that includes the referenced fixes

Patch Information

The fix removes the new links' debugfs entries and stops them before freeing in the error branch of ieee80211_vif_update_links(). The corrected teardown logic is available in the stable tree at Kernel Git Commit 0f7eaeb, Kernel Git Commit 3295894, Kernel Git Commit 901a735, Kernel Git Commit 952c02b, and Kernel Git Commit c57d97f.

Workarounds

Unmount or restrict debugfs on production systems where kernel debugging is not required
Disable Multi-Link Operation on affected wireless drivers until the patch is applied
Limit which local users can invoke nl80211 link management operations through capability restrictions

bash

# Restrict debugfs to root only
mount -o remount,mode=0700 /sys/kernel/debug

# Verify installed kernel includes the mac80211 teardown fix
zgrep -i 'mac80211: tear down new links' /usr/share/doc/linux-image-*/changelog* 2>/dev/null