In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps… (CVE-2026-98708)

The Linux kernel's mac80211 Wi-Fi component had a flaw in managing paired channel contexts (chanctx). An in-place replacement mechanism maintains reciprocal pointers between an old chanctx marked WILL_BE_REPLACED and a new chanctx marked REPLACES_OTHER. However, early free paths only accounted for assigned and reserved link users when deciding to free the old chanctx, allowing it to be freed prematurely while the replacement still pointed to it. This could cause later unreserve and switch-finalization code to follow stale pointers. The patch modifies the checks in __ieee80211_link_release_channel() and ieee80211_link_use_reserved_reassign() to keep the old chanctx alive until the replacement pair is completely torn down. If the replacement is abandoned, the existing ieee80211_link_unreserve_chanctx() function properly tears down the pairing before freeing the old chanctx.

The vulnerability could lead to use-after-free conditions in the mac80211 Wi-Fi subsystem of the Linux kernel, potentially causing kernel crashes or undefined behavior. No specific exploitation details or active exploits are reported. The impact is limited to kernel stability and reliability related to Wi-Fi channel context management.

A fix has been applied to the Linux kernel to address this issue by ensuring the old channel context is not freed prematurely. Users should update to a Linux kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigations are indicated.