VulnerabilityPublished 18 Oct 2026Updated 21 Oct 2026

CVE-2026-98708: Linux kernel · wifi: mac80211: keep paired old chanctx alive

Source GCVE Database

Authoritative record:CVE-2026-98708

Not known to be exploited · fixed in afd1cdd16a25c7185b812a612ab7d5f2cbd1e086 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in afd1cdd16a25c7185b812a612ab7d5f2cbd1e086, 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8, 3412e9a800786d1dec4a58367db1cba275e7ef11 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-84vh-fqvc-p664

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < afd1cdd16a25c7185b812a612ab7d5f2cbd1e086	Fixed in afd1cdd16a25c7185b812a612ab7d5f2cbd1e086
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8	Fixed in 47864a9092fd6f6b3f312d1e5b233ecdc68b1bd8
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 3412e9a800786d1dec4a58367db1cba275e7ef11	Fixed in 3412e9a800786d1dec4a58367db1cba275e7ef11
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2	Fixed in 21a688cbeae0e682f03e91f1e7a7eedd60d9d4f2
LinuxLinux	Affected ≥ 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f, < 1c82d0c5d509179ba2a4edfa096f516aebf960b0	Fixed in 1c82d0c5d509179ba2a4edfa096f516aebf960b0
LinuxLinux	Affected =3.17	Fixed in–

AI-suggested

A fix has been applied to the Linux kernel to address this issue by ensuring the old channel context is not freed prematurely. Users should update to a Linux kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigations are indicated.

Description

A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem related to channel context management has been resolved. The issue involved premature freeing of an old channel context (chanctx) while its replacement still referenced it, potentially leading to use-after-free conditions. The fix ensures that the old chanctx remains alive until the replacement pair is fully torn down, preventing stale pointer dereferences.

Impact

The vulnerability could lead to use-after-free conditions in the mac80211 Wi-Fi subsystem of the Linux kernel, potentially causing kernel crashes or undefined behavior. No specific exploitation details or active exploits are reported. The impact is limited to kernel stability and reliability related to Wi-Fi channel context management.

Summary

The Linux kernel's mac80211 Wi-Fi component had a flaw in managing paired channel contexts (chanctx). An in-place replacement mechanism maintains reciprocal pointers between an old chanctx marked WILL_BE_REPLACED and a new chanctx marked REPLACES_OTHER. However, early free paths only accounted for assigned and reserved link users when deciding to free the old chanctx, allowing it to be freed prematurely while the replacement still pointed to it. This could cause later unreserve and switch-finalization code to follow stale pointers. The patch modifies the checks in __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign() to keep the old chanctx alive until the replacement pair is completely torn down. If the replacement is abandoned, the existing ieee80211_link_unreserve_chanctx() function properly tears down the pairing before freeing the old chanctx.

References

Community reviews

Loading reviews…