CVE-2026-98341 is a vulnerability in Linux Kernel
Published on October 6, 2026
wifi: cfg80211: don't free driver-owned scan requests
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't free driver-owned scan requests
When an interface goes down while a scan is running, cfg80211 completes
the scan towards userspace and frees the scan request. However, the
driver can be convinced that it owns the request, since the cancellation
is (intended to be) asynchronous.
The WARN_ON() in the netdev notifier was meant to catch this, but it's
not actually avoidable, so it triggers and we get a UAF in scan_done().
There doesn't seem to be a great way around it, so just track that the
driver is still convinced it owns the request, and then just free it on
completion if it was already cancelled. Also remove the warnings since
they can trigger in the intended architecture.
Products Associated with CVE-2026-98341
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 4a58e7c38443154fce1b47910e1a9184f65c5d72 and below e8c75736cfd0c6c87562cda2312e3fe5e2227955 is affected.
- Version 4a58e7c38443154fce1b47910e1a9184f65c5d72 and below cf6da29d17994865f73ca70976495ea856909c63 is affected.
- Version 4a58e7c38443154fce1b47910e1a9184f65c5d72 and below dab68a74e90b8e07f08ed9deaa5884857a3cfe89 is affected.
- Version 3.14 is affected.
- Before 3.14 is unaffected.
- Version 6.18.54, <= 6.18.* is unaffected.
- Version 7.2.8, <= 7.2.* is unaffected.
- Version 7.3-rc4, <= * is unaffected.