CVE-2026-98704

wifi: mac80211: keep fallback association elements alive

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: keep fallback association elements alive

Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities.

When an association response omits WMM, HT, or VHT information, ieee80211_assoc_config_link() parses the cached BSS IEs and copies the missing element pointers out of that fallback parse. For a non-transmitted MBSSID profile those pointers refer to merged-profile storage owned by the parse object, and the fallback block frees that object at its end. The copied pointers are used afterwards to determine the operating channel, configure bandwidth, and apply HT capabilities.

Keep the fallback parse result alive until association setup finishes.

[reorder variable declaration]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 409da4ad76d921b173ebb801e316023f74564239Affected 5023b14cf4df4d22e1a80738167f3438c9e62e5f to before fb47973eecd869ab5662bb39002f6680536caa6cAffected 5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 64183344f6f29ed0cad33d6ec0e769aa5e31fb19Affected 5023b14cf4df4d22e1a80738167f3438c9e62e5f to before de77b0f68142147e74fac1c497dbe1f93daeeed9Affected 5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 1d9644753d46c86b4e5c05bd6d9d35339ea27331Affected 5023b14cf4df4d22e1a80738167f3438c9e62e5f to before d0183cd1f6a2dba9e63be20af2f65093c9c8d121Affected 5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 0878594c5806dd29fa5e16cc026ce19158afdad2Affected 5023b14cf4df4d22e1a80738167f3438c9e62e5f to before a10a2f80476d166fd81c361ec0319493671b694eAffected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 409da4ad76d921b173ebb801e316023f74564239Affected
5023b14cf4df4d22e1a80738167f3438c9e62e5f to before fb47973eecd869ab5662bb39002f6680536caa6cAffected
5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 64183344f6f29ed0cad33d6ec0e769aa5e31fb19Affected
5023b14cf4df4d22e1a80738167f3438c9e62e5f to before de77b0f68142147e74fac1c497dbe1f93daeeed9Affected
5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 1d9644753d46c86b4e5c05bd6d9d35339ea27331Affected
5023b14cf4df4d22e1a80738167f3438c9e62e5f to before d0183cd1f6a2dba9e63be20af2f65093c9c8d121Affected
5023b14cf4df4d22e1a80738167f3438c9e62e5f to before 0878594c5806dd29fa5e16cc026ce19158afdad2Affected
5023b14cf4df4d22e1a80738167f3438c9e62e5f to before a10a2f80476d166fd81c361ec0319493671b694eAffected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.