CVE-2026-98704: Linux Kernel WiFi Use-After-Free Vulnerability

CVE-2026-98704 Overview

CVE-2026-98704 is a use-after-free vulnerability in the Linux kernel mac80211 subsystem. The flaw occurs when a station associates with a non-transmitted Multiple BSSID (MBSSID) profile. During association setup, ieee80211_assoc_config_link() reads memory that has already been freed while determining the operating channel and applying High Throughput (HT) capabilities.

The vulnerability affects wireless association processing when an association response omits Wi-Fi Multimedia (WMM), HT, or Very High Throughput (VHT) information elements. The kernel falls back to cached Basic Service Set (BSS) information elements but frees the parse object before the pointers are consumed.

Critical Impact
Freed memory is dereferenced during Wi-Fi association, which can lead to kernel memory corruption, information disclosure, or denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the mac80211 MBSSID association code path
Systems using Wi-Fi hardware that connects to networks advertising non-transmitted MBSSID profiles
Linux stable branches prior to the commits referenced in the fix set

Discovery Timeline

2026-10-18 - CVE-2026-98704 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98704

Vulnerability Analysis

The defect lives in the mac80211 subsystem, which implements the software MAC layer for Linux Wi-Fi drivers. When a client associates with a non-transmitted profile inside an MBSSID beacon, the kernel must merge information elements from the transmitted profile with those from the nested non-transmitted profile.

If the association response from the access point omits WMM, HT, or VHT elements, ieee80211_assoc_config_link() parses the cached BSS IEs to recover the missing fields. For MBSSID non-transmitted profiles, those parsed pointers reference merged-profile storage owned by a temporary parse object. The fallback block then frees that parse object before association setup completes.

The stale pointers are later used to determine the operating channel, configure bandwidth, and apply HT capabilities. Any read against this freed region operates on uninitialized or reallocated kernel memory.

Root Cause

The root cause is a lifetime mismatch between a transient parse object and the pointers copied out of it. The fallback parse result is released at the end of the fallback block, but downstream association logic still holds references into that storage. This is a classic use-after-free pattern involving ownership of merged MBSSID element buffers.

Attack Vector

Exploitation requires a client to associate with a malicious or malformed access point advertising a non-transmitted MBSSID profile. The access point must send an association response that omits WMM, HT, or VHT information elements, forcing the fallback parse path. An attacker within radio range of the target can host a crafted SSID to trigger the vulnerable code path during the victim's association attempt.

No authenticated user interaction on the target host is required beyond initiating or accepting an association. Successful exploitation yields kernel-level memory corruption primitives.

See the upstream fix in Linux Kernel Commit a10a2f80 and related backports for the full code change.

Detection Methods for CVE-2026-98704

Indicators of Compromise

Kernel Address Sanitizer (KASAN) splats referencing ieee80211_assoc_config_link or MBSSID element parsing on wireless-enabled hosts.
Unexpected Wi-Fi disconnections, kernel oopses, or panics correlated with association attempts to new SSIDs.
dmesg entries from mac80211 indicating malformed or missing WMM, HT, or VHT elements during association.

Detection Strategies

Audit kernel versions across the Linux fleet and compare them against the fixed commits listed in the vendor references.
Monitor crash telemetry and kdump artifacts for faults originating in net/mac80211/mlme.c association paths.
Correlate wireless scan logs with host crash events to identify rogue access points advertising unusual MBSSID structures.

Monitoring Recommendations

Collect kernel ring buffer logs centrally and alert on mac80211 warnings or BUG messages.
Track wireless association events on managed endpoints, including BSSID, SSID, and capability negotiation outcomes.
Enable kernel lockdown and KASAN on fleet test systems to surface memory safety regressions earlier.

How to Mitigate CVE-2026-98704

Immediate Actions Required

Apply the Linux stable kernel updates that include the fix commits as soon as distribution packages are available.
Inventory all Linux systems with active Wi-Fi interfaces, including workstations, laptops, embedded devices, and IoT endpoints.
Prioritize patching mobile and field-deployed systems that routinely associate with untrusted wireless networks.

Patch Information

The fix keeps the fallback parse result alive until association setup finishes, eliminating the use-after-free window. Backports are available across multiple stable branches. Refer to the upstream commits:

Workarounds

Disable Wi-Fi interfaces on systems that do not require wireless connectivity until the kernel is updated.
Restrict association to known trusted SSIDs using wireless profile allowlists managed via NetworkManager or wpa_supplicant.
Avoid associating with unknown or public access points on vulnerable hosts, particularly in dense wireless environments where rogue MBSSID beacons are easier to stage.