In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group… (CVE-2026-98823)

The vulnerability in the Linux kernel's wifi cfg80211 subsystem involves improper handling of beacon Information Elements (IEs) for hidden-group probe-response entries. Specifically, these entries borrow beacon IEs from the group's beacon entry, and during scan entry merging after a channel switch, the function cfg80211_update_assoc_bss_entry() can pass such an entry to cfg80211_update_known_bss(). This results in the same beacon IE allocation having two owners. When the group's beacon entry is released, the associated entry ends up pointing to freed IEs, which are then freed again upon release, causing a use-after-free condition. The patch addresses this by skipping beacon IE replacement when the source entry belongs to a hidden group, while maintaining probe-response processing and metadata updates.

The vulnerability can lead to use-after-free conditions in the kernel's wifi subsystem, potentially causing system instability or crashes. No information about exploitation in the wild or further impact is provided.

A fix has been implemented to prevent double freeing of beacon IEs by skipping beacon IE replacement for hidden-group entries. Users should apply the official Linux kernel update that resolves this issue. No additional mitigation steps are indicated.