In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a… (CVE-2026-98704)

The vulnerability in the Linux kernel's mac80211 component involves use-after-free memory access during WiFi association with a non-transmitted MBSSID profile. Specifically, when an association response omits WMM, HT, or VHT information, the ieee80211_assoc_config_link() function uses cached BSS information elements (IEs) from a fallback parse. For non-transmitted MBSSID profiles, these pointers refer to memory owned by the parse object, which is freed before the pointers are used, leading to use-after-free. The patch keeps the fallback parse result alive until the association setup finishes, preventing access to freed memory.

This vulnerability could lead to undefined behavior such as kernel crashes or potential memory corruption due to use-after-free conditions during WiFi association. No specific exploit or active attacks are reported. The impact is limited to affected Linux kernel WiFi functionality during association with certain MBSSID profiles.

A fix has been implemented that keeps the fallback parse result alive until association setup completes, preventing use-after-free. Users should apply the official Linux kernel update that includes this patch once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.