SB2026100735 - Use-after-free in Linux kernel wireless

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98341)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to premature freeing of driver-owned scan requests in the cfg80211 scan completion handling when a wireless interface goes down while a scan is running. A local user can cause an interface to go down during an active scan to trigger a use-after-free in the kernel.

Scan cancellation is asynchronous, so the driver may still reference the request after cfg80211 has completed the scan towards userspace.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/cf6da29d17994865f73ca70976495ea856909c63
• https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89
• https://git.kernel.org/stable/c/e8c75736cfd0c6c87562cda2312e3fe5e2227955