CVE-2026-98709

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: count only matching reservations in reserved switch

ieee80211_vif_use_reserved_switch() validates a replacement by counting

assigned links on ctx->replace_ctx and treating reservations too

broadly. A link can still be assigned to the old channel context while

holding a reservation that belongs to a different replacement

operation.

That can make the current replacement appear complete too early. If

another link finalizes first, the function can free the

WILL_BE_REPLACED chanctx while the unmatched link and driver still use

it, leading to a use-after-free in later beacon generation.

Require an in-place reservation to point at the current replacement

context, and require the reserved and assigned contexts to be the

matching replacement pair, before counting or moving the link.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References