In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch… (CVE-2026-98709)

The vulnerability in the Linux kernel's mac80211 WiFi component stemmed from ieee80211_vif_use_reserved_switch() incorrectly counting assigned links and reservations during channel context replacements. It treated reservations too broadly, allowing a link to remain assigned to an old channel context while holding a reservation for a different replacement operation. This caused the replacement to appear complete prematurely, potentially freeing the WILL_BE_REPLACED channel context while it was still in use by unmatched links and the driver, resulting in a use-after-free condition during beacon generation. The fix requires that in-place reservations must point to the current replacement context and that reserved and assigned contexts match before links are counted or moved.

The vulnerability could lead to use-after-free conditions in the WiFi subsystem, potentially causing kernel crashes or instability during wireless beacon generation. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this vulnerability by enforcing stricter checks on channel context reservations during replacement. Users should apply the official kernel update that includes this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.