CVE-2026-98823: wifi: cfg80211: preserve hidden-group beacon IE ownership
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: preserve hidden-group beacon IE ownership
A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry() can pass such an entry to cfg80211updateknownbss() when merging scan entries after a channel switch.
Copying the borrowed beaconies into the associated entry gives the same allocation two owners. Releasing the group's beacon entry can then leave the associated entry pointing to freed IEs, which are freed again when that entry is released.
Skip beacon IE replacement when the source entry belongs to a hidden group. Preserve probe-response processing, the subsequent metadata updates, and the existing rejection path for conflicting hidden beacon updates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
What runtime conditions can trigger the faulty ownership transfer?
The issue can occur when cfg80211 merges scan entries after a channel switch and cfg80211_update_assoc_bss_entry() passes a hidden-group probe-response entry to cfg80211_update_known_bss(). The probe-response entry borrows beacon information elements from its group’s beacon entry.
What is the consequence of reaching the affected code path?
The same beacon IE allocation can be assigned to both the group beacon entry and the associated entry. Releasing the group entry can leave the associated entry with a freed pointer, and releasing that entry later can free the allocation again.
What does the resolved change do?
It skips replacement of beacon IEs when the source entry belongs to a hidden group, avoiding the duplicate ownership. Probe-response processing, later metadata updates, and rejection of conflicting hidden beacon updates remain in place.