VulnerabilityPublished 18 Oct 2026Updated 21 Oct 2026

CVE-2026-98708: Linux kernel · wifi: mac80211: keep paired old chanctx alive

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in afd1cdd16a25c7185b812a612ab7d5f2cbd1e086 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in afd1cdd16a25c7185b812a612ab7d5f2cbd1e086, 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8, 3412e9a800786d1dec4a58367db1cba275e7ef11 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < afd1cdd16a25c7185b812a612ab7d5f2cbd1e086	Fixed in afd1cdd16a25c7185b812a612ab7d5f2cbd1e086
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8	Fixed in 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 3412e9a800786d1dec4a58367db1cba275e7ef11	Fixed in 3412e9a800786d1dec4a58367db1cba275e7ef11
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2	Fixed in 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 1c82d0c5d509179ba2a4edfa096f516aebf960b0	Fixed in 1c82d0c5d509179ba2a4edfa096f516aebf960b0
LinuxLinux	Affected =3.17	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. However, the early free paths only consider assigned and reserved link users when deciding whether to free the old chanctx. That lets the old chanctx be freed too early while the replacement partner still points back to it, either when the last assigned link is released or when that link successfully reassigns to another existing context. Later unreserve and switch-finalization paths can then follow a stale replace_ctx pointer. Keep a paired old chanctx alive until the replacement pair has been torn down. Apply the same check to both __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign(). If the replacement is later abandoned, ieee80211_link_unreserve_chanctx() already tears down the pairing before freeing the old chanctx once no users remain.

References

Community reviews

Loading reviews…