CVE-2026-98823

wifi: cfg80211: preserve hidden-group beacon IE ownership

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: preserve hidden-group beacon IE ownership

A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211_update_assoc_bss_entry() can pass such an entry to cfg80211_update_known_bss() when merging scan entries after a channel switch.

Copying the borrowed beacon_ies into the associated entry gives the same allocation two owners. Releasing the group's beacon entry can then leave the associated entry pointing to freed IEs, which are freed again when that entry is released.

Skip beacon IE replacement when the source entry belongs to a hidden group. Preserve probe-response processing, the subsequent metadata updates, and the existing rejection path for conflicting hidden beacon updates.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 00f83d39675adc12d56957a1f5e316812157e4d3Affected 0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 3c44f780d1738e9ddf438729f5ff6ceb45f9ded3Affected 0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 8f79f429dc87a4f21e4fcf9a4d3df9484ca9a294Affected 0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 5617d5328839003c91007ce906b4f100b43926e9Affected 0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 49b66110a08e4f926f6393e938f226de2750a08bAffected 0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before dd7973a4130b0862be38d7e08cc0e874b3d99967Affected 0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 5f27581c176f84b52ec0ab9be7b500c10667ef60Affected 0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before cc45f313d85533d647ce619326302aad6f797c14Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 00f83d39675adc12d56957a1f5e316812157e4d3Affected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 3c44f780d1738e9ddf438729f5ff6ceb45f9ded3Affected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 8f79f429dc87a4f21e4fcf9a4d3df9484ca9a294Affected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 5617d5328839003c91007ce906b4f100b43926e9Affected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 49b66110a08e4f926f6393e938f226de2750a08bAffected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before dd7973a4130b0862be38d7e08cc0e874b3d99967Affected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before 5f27581c176f84b52ec0ab9be7b500c10667ef60Affected
0afd425b1b64251f19b5d8d8b49bf56fefbc643f to before cc45f313d85533d647ce619326302aad6f797c14Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.