CVE-2026-98708

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: keep paired old chanctx alive

An in-place replacement keeps reciprocal replace_ctx pointers between

the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx.

However, the early free paths only consider assigned and reserved link

users when deciding whether to free the old chanctx.

That lets the old chanctx be freed too early while the replacement

partner still points back to it, either when the last assigned link is

released or when that link successfully reassigns to another existing

context. Later unreserve and switch-finalization paths can then follow a

stale replace_ctx pointer.

Keep a paired old chanctx alive until the replacement pair has been torn

down. Apply the same check to both __ieee80211_link_release_channel()

and ieee80211_link_use_reserved_reassign(). If the replacement is later

abandoned, ieee80211_link_unreserve_chanctx() already tears down the

pairing before freeing the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References