CVE-2026-98709: wifi: mac80211: count only matching reservations in reserved switch
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: count only matching reservations in reserved switch
ieee80211vifusereservedswitch() validates a replacement by counting assigned links on ctx->replacectx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation.
That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILLBEREPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation.
Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using the mac80211 Wi-Fi subsystem are relevant. The faulty path involves reserved channel-context replacement operations where a link can remain assigned to an old channel context while holding a reservation for a different replacement operation.
What happens when the incorrect replacement accounting is triggered?
A replacement can be considered complete prematurely. If another link finalizes first, the channel context marked WILL_BE_REPLACED can be freed while an unmatched link and its driver still use it, causing a use-after-free during later beacon generation.
What does the resolved fix change?
The fix counts or moves a link only when its in-place reservation points to the current replacement context, and when the reserved and assigned contexts form the matching replacement pair.