CVE-2026-64570: wifi: mac80211: fix fils_discovery double free on alloc failure
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix filsdiscovery double free on alloc failure
ieee80211setfilsdiscovery() calls kfreercu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.filsdiscovery still points at the object already queued for freeing. A later update or AP teardown (ieee80211stopap()) re-queues that same rcuhead; the second free is caught by KASAN when the RCU sheaf is processed in softirq:
BUG: KASAN: double-free in rcufreesheaf (mm/slub.c:5850) Free of addr ffff88800c065280 by task swapper/0/0 ... rcufreesheafprepare (mm/slub.c:2634 mm/slub.c:2940) rcufreesheaf (mm/slub.c:5850) rcucore (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handlesoftirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-96 of size 96
Queue the old object for kfreercu() only after the new one is published, matching ieee80211setproberesp() and ieee80211sets1gshortbeacon().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix described: in the RCU sheaf free preparation path (__rcu_free_sheaf_prepare in mm/slub.c), queue the old object for kfree_rcu() only after the new one is published, and only after the replacement allocation succeeds; this prevents the double-free when the old ieee80211 fils_discovery template is already queued for freeing.
Linux kernel (mm/slub.c / RCU kfree_rcu path) RCU sheaf free behavior = Queue old object for kfree_rcu only after the new one is published (and after successful replacement allocation)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64570?
The severity of CVE-2026-64570 is rated at 38.
How do I fix CVE-2026-64570?
To fix CVE-2026-64570, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-64570?
CVE-2026-64570 is classified as a double free vulnerability.
What software is affected by CVE-2026-64570?
CVE-2026-64570 affects the Linux kernel.
What function is involved in the CVE-2026-64570 vulnerability?
The vulnerability in CVE-2026-64570 involves the ieee80211_set_fils_discovery() function.