CVE-2026-98326: wifi: mac80211: mesh: release the channel if start fails
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: mesh: release the channel if start fails
ieee80211joinmesh() acquires a channel context and then calls ieee80211startmesh(), which can fail. In that case, the chanctx isn't released then interface removal will attempt to unassign it after it's removed from the driver, hitting:
wlan0: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.c:366 at drvunassignvifchanctx ieee80211assignlinkchanctx ieee80211linkreleasechannel ieee80211linkreleasechannel ieee80211teardownsdata unregisternetdevicemanynotify cfg80211unregisterwdev ieee80211removeinterfaces ieee80211unregisterhw mac80211hwsimdelradio hwsimexitnet
Correctly release the channel on start failures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's mac80211 mesh functionality are relevant. The failure path involves a mesh join that acquires a channel context but then fails to start the mesh interface.
What condition triggers the warning?
The issue occurs when ieee80211_start_mesh() fails after ieee80211_join_mesh() has acquired a channel context. Later interface removal attempts to unassign a channel context after the interface has already been removed from the driver, producing a driver check warning.
How can I identify that a system has encountered the issue?
Kernel logs may contain a warning beginning with "wlan0: Failed check-sdata-in-driver check" and reference drv_unassign_vif_chanctx, ieee80211_link_release_channel, and interface teardown or unregister operations.
What does the fix do?
The fix releases the acquired channel context when mesh startup fails, preventing later interface removal from trying to unassign that context after it has been removed from the driver.