Use-after-free in Linux kernel - CVE-2026-98341

Vulnerability identifier: #VU153690

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98341

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to premature freeing of driver-owned scan requests in the cfg80211 scan completion handling when a wireless interface goes down while a scan is running. A local user can cause an interface to go down during an active scan to trigger a use-after-free in the kernel.

Scan cancellation is asynchronous, so the driver may still reference the request after cfg80211 has completed the scan towards userspace.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/cf6da29d17994865f73ca70976495ea856909c63
• https://git.kernel.org/stable/c/dab68a74e90b8e07f08ed9deaa5884857a3cfe89
• https://git.kernel.org/stable/c/e8c75736cfd0c6c87562cda2312e3fe5e2227955

• Use-after-free in Linux kernel wireless
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more