CVE-2026-98823: Linux Kernel WiFi Use-After-Free Vulnerability

CVE-2026-98823 Overview

CVE-2026-98823 is a memory management flaw in the Linux kernel's cfg80211 wireless configuration subsystem. The vulnerability affects how hidden-group probe-response entries share beacon Information Elements (IEs) with their parent group's beacon entry. When cfg80211_update_assoc_bss_entry() passes a hidden-group entry to cfg80211_update_known_bss() during a channel switch merge, the borrowed beacon_ies allocation can end up with two owners. Releasing the group's beacon entry can leave the associated entry pointing to freed memory, which is then freed again when that entry is released. The resulting double-free condition impacts kernel memory integrity in Wi-Fi scan handling paths.

Critical Impact
A double-free in cfg80211 beacon IE handling can corrupt kernel heap memory, potentially leading to denial of service or local privilege escalation on systems processing hidden-SSID Wi-Fi networks.

Affected Products

Linux kernel versions containing the vulnerable cfg80211_update_assoc_bss_entry() logic
Distributions shipping affected mainline and stable kernel branches
Systems with Wi-Fi hardware using the cfg80211 wireless configuration framework

Discovery Timeline

2026-10-18 - CVE-2026-98823 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98823

Vulnerability Analysis

The vulnerability resides in the Linux kernel's cfg80211 layer, which manages wireless scan results and Basic Service Set (BSS) entries. Hidden Service Set Identifier (SSID) networks produce a group entry (the beacon) and one or more probe-response entries that borrow the beacon's IEs rather than owning them. The flaw emerges when cfg80211_update_assoc_bss_entry() merges scan results after an 802.11 channel switch event. The merge path invokes cfg80211_update_known_bss(), which copies the borrowed beacon_ies pointer into the associated entry without transferring exclusive ownership.

Two distinct BSS entries now reference the same allocation. When the kernel releases the group's beacon entry, it frees the shared IE buffer. The associated entry still holds a stale pointer. When that entry is later released, the kernel frees the same allocation a second time, triggering a double-free on the kernel slab allocator.

Root Cause

The root cause is improper ownership tracking of beacon IE memory between hidden-group beacon entries and their associated probe-response entries. The merge logic treats the borrowed reference as if it were an owned allocation and performs replacement without checking whether the source entry is part of a hidden group. This maps to a double-free condition rooted in shared-pointer mishandling.

Attack Vector

Triggering the condition requires the kernel to process scan entries for a hidden-SSID network that performs a channel switch while the station is associated. An attacker within radio range who operates a rogue access point can advertise a hidden SSID and issue channel-switch announcements to drive the vulnerable code path. The upstream fix skips beacon IE replacement when the source entry belongs to a hidden group, preserves probe-response processing, and retains the existing rejection path for conflicting hidden beacon updates.

No verified public exploit code is available. See the upstream commits for the authoritative fix: Linux Kernel Commit 49b6611, Linux Kernel Commit 5617d53, Linux Kernel Commit 5f27581, Linux Kernel Commit cc45f31, and Linux Kernel Commit dd7973a.

Detection Methods for CVE-2026-98823

Indicators of Compromise

Kernel log entries referencing slab corruption, KASAN: use-after-free, or double-free detections tied to cfg80211 symbols such as cfg80211_update_known_bss or cfg80211_update_assoc_bss_entry.
Unexpected kernel panics or oopses on systems that recently associated with hidden-SSID networks and processed channel-switch events.
Repeated Wi-Fi driver resets or disassociations correlated with scan or roam activity.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) and SLUB_DEBUG on test fleets to surface the double-free at the point of corruption rather than at a downstream crash.
Monitor kernel ring buffer output (dmesg) for cfg80211 stack traces associated with BSS entry release.
Correlate wireless driver events with kernel crash telemetry to identify affected hosts in the environment.

Monitoring Recommendations

Centralize kernel crash dumps and kdump artifacts for triage across endpoints and servers running Linux with Wi-Fi hardware.
Track installed kernel versions against distribution patch advisories to confirm coverage of the five upstream fix commits.
Alert on anomalous wireless-stack reload patterns, which can indicate the vulnerable code path has been exercised.

How to Mitigate CVE-2026-98823

Immediate Actions Required

Identify Linux hosts running vulnerable kernel versions and prioritize patching for mobile and laptop fleets that routinely attach to Wi-Fi networks.
Apply the stable kernel update that includes the cfg80211 hidden-group beacon IE ownership fix.
Reboot patched systems to ensure the updated kernel image is active.

Patch Information

The fix is available in the upstream Linux kernel through the following commits: 49b66110a08e, 5617d5328839, 5f27581c176f, cc45f313d855, and dd7973a4130b. Consult your Linux distribution's security tracker for backported package versions and apply vendor-provided updates through the standard package manager.

Workarounds

Disable Wi-Fi on affected systems where wireless connectivity is not required until the patched kernel is deployed.
Avoid associating with hidden-SSID networks on unpatched systems, since the vulnerable path depends on hidden-group beacon handling.
Restrict scan activity in managed environments by limiting background scanning in NetworkManager or wpa_supplicant configurations.

bash

# Verify running kernel version and check for the fix
uname -r

# Debian/Ubuntu: update the kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-generic

# RHEL/Fedora: update the kernel package
sudo dnf update kernel

# Temporary workaround: unload the Wi-Fi stack where feasible
sudo rmmod cfg80211