Linux Kernel: cfg80211 Hidden-Group Beacon IE Ownership Double-Free
CVE-2026-98823 Published on October 18, 2026
wifi: cfg80211: preserve hidden-group beacon IE ownership
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: preserve hidden-group beacon IE ownership
A hidden-group probe-response entry borrows its beacon IEs from the
group's beacon entry. cfg80211_update_assoc_bss_entry() can pass such
an entry to cfg80211_update_known_bss() when merging scan entries
after a channel switch.
Copying the borrowed beacon_ies into the associated entry gives the
same allocation two owners. Releasing the group's beacon entry can
then leave the associated entry pointing to freed IEs, which are
freed again when that entry is released.
Skip beacon IE replacement when the source entry belongs to a hidden
group. Preserve probe-response processing, the subsequent metadata
updates, and the existing rejection path for conflicting hidden
beacon updates.
Products Associated with CVE-2026-98823
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 0afd425b1b64251f19b5d8d8b49bf56fefbc643f and below 49b66110a08e4f926f6393e938f226de2750a08b is affected.
- Version 0afd425b1b64251f19b5d8d8b49bf56fefbc643f and below dd7973a4130b0862be38d7e08cc0e874b3d99967 is affected.
- Version 0afd425b1b64251f19b5d8d8b49bf56fefbc643f and below 5f27581c176f84b52ec0ab9be7b500c10667ef60 is affected.
- Version 0afd425b1b64251f19b5d8d8b49bf56fefbc643f and below cc45f313d85533d647ce619326302aad6f797c14 is affected.
- Version 5.4 is affected.
- Before 5.4 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.