CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix unsolbcastproberesp double free on alloc failure
ieee80211setunsolbcastproberesp() calls kfreercu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.unsolbcastproberesp still points at the object already queued for freeing. A later update or AP teardown re-queues that same rcuhead; the second free is caught by KASAN when the RCU sheaf is processed in softirq:
BUG: KASAN: double-free in rcufreesheaf (mm/slub.c:5850) Free of addr ffff88800d06f300 by task exploit/145 ... rcufreesheafprepare (mm/slub.c:2634 mm/slub.c:2940) rcufreesheaf (mm/slub.c:5850) rcucore (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handlesoftirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-128 of size 128
Queue the old object for kfreercu() only after the new one is published, matching ieee80211setproberesp() and ieee80211sets1gshortbeacon().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix “Queue the old object for kfree_rcu() only after the new one is published” for the double-free in rcu_free_sheaf (mm/slub.c) / wifi mac80211 unsol_bcast_probe_resp double free on alloc failure, as described in the provided patch context.
Linux kernel (mm/slub.c / RCU) RCU sheaf free ordering = Queue the old object for kfree_rcu() only after the new one is published
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64568?
CVE-2026-64568 has a risk rating of 34, indicating a moderate level of severity.
How do I fix CVE-2026-64568?
To resolve CVE-2026-64568, update the Linux kernel to the latest version that includes the fix.
What does CVE-2026-64568 affect?
CVE-2026-64568 affects the Linux kernel, specifically the mac80211 component related to Wi-Fi.
What is the nature of the vulnerability in CVE-2026-64568?
CVE-2026-64568 involves a double free memory issue that can occur upon allocation failure.
When was CVE-2026-64568 published?
CVE-2026-64568 was published on August 5, 2026.