CVE-2026-98195: wifi: iwlegacy: fix broadcast stations deallocation
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlegacy: fix broadcast stations deallocation
On the error path of il4965up(), ildeallocbcaststations() clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by il4965down().
This can occur when RFKILL is toggled during driver startup.
To fix clear the entire 'used' field, since we will not do any other operations on the station.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
On the error path of __il4965_up(), clear the entire 'used' field in il_dealloc_bcast_stations(), rather than clearing only IL_STA_UCODE_ACTIVE, so broadcast stations are not deallocated again by __il4965_down().
Linux kernel iwlegacy (__il4965_up()/il_dealloc_bcast_stations()) used field = clear the entire field
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The issue can occur when RF_KILL is toggled while the iwlegacy driver is starting up. In that error path, broadcast stations may be deallocated and then deallocated again during driver shutdown.
Which systems are affected?
The affected component is the iwlegacy Wi-Fi driver in the Linux kernel. Systems not using this driver are not indicated by the provided information as exposed to this issue.
What does the fix change?
The fix clears the broadcast station's entire used field during deallocation, rather than clearing only IL_STA_UCODE_ACTIVE. This prevents the later shutdown path from treating the same broadcast stations as still allocated.