Strix
73.2K

CVE-2026-98708

UnknownEPSS 0.17%

Last modified

CVE-2026-98708 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider assigned and reserved link users when deciding whether to free the old chanctx. That lets the old chanctx be freed too early while the replacement partner still points back to it, either when the last assigned link is released or when that link successfully reassigns to another existing context. Later unreserve and switch-finalization paths can then follow a stale replace_ctx pointer. Keep a paired old chanctx alive until the replacement pair has been torn down. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider assigned and reserved link users when deciding whether to free the old chanctx. That lets the old chanctx be freed too early while the replacement partner still points back to it, either when the last assigned link is released or when that link successfully reassigns to another existing context. Later unreserve and switch-finalization paths can then follow a stale replace_ctx pointer. Keep a paired old chanctx alive until the replacement pair has been torn down. Apply the same check to both __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign(). If the replacement is later abandoned, ieee80211_link_unreserve_chanctx() already tears down the pairing before freeing the old chanctx once no users remain.

Metrics

EPSS Probability
0.17%

6.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 026ae72fa6d0f7e04951441026be473f22911b87; >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 624bf5338d8c2f55db455ce4f2543ca4a83fab03; >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 0fba8fbf5ab0bffc1866e5038aaab772d31d1584; >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8; >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2; >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 1c82d0c5d509179ba2a4edfa096f516aebf960b0; >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < afd1cdd16a25c7185b812a612ab7d5f2cbd1e086; >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 3412e9a800786d1dec4a58367db1cba275e7ef11
LinuxLinux3.17

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98708?
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider assigned and reserved link users when deciding whether to free the old chanctx. That lets the old chanctx be freed too early while the replacement partner still points back to it, either when the last assigned link is released or when that link successfully reassigns to another existing context. Later unreserve and switch-finalization paths can then follow a stale replace_ctx pointer. Keep a paired old chanctx alive until the replacement pair has been torn down. Apply the same check to both __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign(). If the replacement is later abandoned, ieee80211_link_unreserve_chanctx() already tears down the pairing before freeing the old chanctx once no users remain.
How severe is CVE-2026-98708?
Severity scoring for CVE-2026-98708 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98708?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98708?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST