wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-64568
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-05 08:16:36 UTC
Updated2026-08-05 08:16:36 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.unsol_bcast_probe_resp still points at the object already queued for freeing. A later update or AP teardown re-queues that same rcu_head; the second free is caught by KASAN when the RCU sheaf is processed in softirq: BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850) Free of addr ffff88800d06f300 by task exploit/145 ... __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940) rcu_free_sheaf (mm/slub.c:5850) rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-128 of size 128 Queue the old object for kfree_rcu() only after the new one is published, matching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().

Risk And Classification

EPSS: 0.001560000 probability, percentile 0.052580000 (date 2026-08-06)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3b1c256eb4aedfc71dd97d5951ccff824b41d628 ca27a81cd77b698e5eb586a011bee6800c7ee4bd git Not specified
CNA Linux Linux affected 3b1c256eb4aedfc71dd97d5951ccff824b41d628 d62b55b7c7dc62887d7fd5648fb38f0bfaef53ae git Not specified
CNA Linux Linux affected 3b1c256eb4aedfc71dd97d5951ccff824b41d628 0ace76e410d7f7d813b605825a3e593a79c3958f git Not specified
CNA Linux Linux affected 3b1c256eb4aedfc71dd97d5951ccff824b41d628 1d067abcd37062426c59ec73dbc4e87a63f33fea git Not specified
CNA Linux Linux affected 6.7 Not specified
CNA Linux Linux unaffected 6.7 semver Not specified
CNA Linux Linux unaffected 6.12.101 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.42 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.6 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc4 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/0ace76e410d7f7d813b605825a3e593a79c3958f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d62b55b7c7dc62887d7fd5648fb38f0bfaef53ae 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1d067abcd37062426c59ec73dbc4e87a63f33fea 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ca27a81cd77b698e5eb586a011bee6800c7ee4bd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report