CVE-2026-98823: wifi: cfg80211: preserve hidden-group beacon IE ownership

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: preserve hidden-group beacon IE ownership

A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry() can pass such an entry to cfg80211updateknownbss() when merging scan entries after a channel switch.

Copying the borrowed beaconies into the associated entry gives the same allocation two owners. Releasing the group's beacon entry can then leave the associated entry pointing to freed IEs, which are freed again when that entry is released.

Skip beacon IE replacement when the source entry belongs to a hidden group. Preserve probe-response processing, the subsequent metadata updates, and the existing rejection path for conflicting hidden beacon updates.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

What runtime conditions can trigger the faulty ownership transfer?

The issue can occur when cfg80211 merges scan entries after a channel switch and cfg80211_update_assoc_bss_entry() passes a hidden-group probe-response entry to cfg80211_update_known_bss(). The probe-response entry borrows beacon information elements from its group’s beacon entry.

What is the consequence of reaching the affected code path?

The same beacon IE allocation can be assigned to both the group beacon entry and the associated entry. Releasing the group entry can leave the associated entry with a freed pointer, and releasing that entry later can free the allocation again.

What does the resolved change do?

It skips replacement of beacon IEs when the source entry belongs to a hidden group, avoiding the duplicate ownership. Probe-response processing, later metadata updates, and rejection of conflicting hidden beacon updates remain in place.

CVE-2026-98823: wifi: cfg80211: preserve hidden-group beacon IE ownership

Affected Software

Event History

Frequently Asked Questions

What runtime conditions can trigger the faulty ownership transfer?

What is the consequence of reaching the affected code path?

What does the resolved change do?

Company

Resources

Contact

Frequently Asked Questions

What runtime conditions can trigger the faulty ownership transfer?

What is the consequence of reaching the affected code path?

What does the resolved change do?