CVE-2026-98709
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: count only matching reservations in reserved switch
ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation.
That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation.
Read full descriptionShow less
Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.17 %
- Percentile among all scored CVEs
- 6
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Show 4 references
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98709",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
"lessThan": "d31f655e44631891788ca67018ec5e1ed1c7de86",
"versionType": "git"
},
{
"status": "affected",
"version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
"lessThan": "03525b632908b049f4d04cc8a71cdff2329589cf",
"versionType": "git"
},
{
"status": "affected",
"version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
"lessThan": "5cc54a000960bc88f8c58940164dca0e601ab39c",
"versionType": "git"
},
{
"status": "affected",
"version": "5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f",
"lessThan": "437f3727b4fd715266c296435c116288f82666fd",
"versionType": "git"
}
],
"programFiles": [
"net/mac80211/chan.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mac80211/chan.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:24.437",
"references": [
{
"url": "https://git.kernel.org/stable/c/03525b632908b049f4d04cc8a71cdff2329589cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/437f3727b4fd715266c296435c116288f82666fd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5cc54a000960bc88f8c58940164dca0e601ab39c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d31f655e44631891788ca67018ec5e1ed1c7de86",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: count only matching reservations in reserved switch\n\nieee80211_vif_use_reserved_switch() validates a replacement by counting\nassigned links on ctx->replace_ctx and treating reservations too\nbroadly. A link can still be assigned to the old channel context while\nholding a reservation that belongs to a different replacement\noperation.\n\nThat can make the current replacement appear complete too early. If\nanother link finalizes first, the function can free the\nWILL_BE_REPLACED chanctx while the unmatched link and driver still use\nit, leading to a use-after-free in later beacon generation.\n\nRequire an in-place reservation to point at the current replacement\ncontext, and require the reserved and assigned contexts to be the\nmatching replacement pair, before counting or moving the link."
}
],
"lastModified": "2026-10-19T10:19:35.190",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}