Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98326
Published: October 7, 2026
Vulnerability identifier: #VU153700
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98326
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger a kernel warning.
The vulnerability exists due to failure to release an acquired channel context in ieee80211_join_mesh() when mesh startup fails. A local user can trigger a mesh startup failure followed by interface removal to trigger a kernel warning.
During interface removal, the channel context is unassigned after the interface has already been removed from the driver.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98326
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/41bee71112db53651ba9a9030de1b843255a4a7f
- https://git.kernel.org/stable/c/4a4e3fa77ea36d3419d806fb5883ef425a605a5d
- https://git.kernel.org/stable/c/632f7acfe6dac1278a9314eaaab14fada400ddaf
- https://git.kernel.org/stable/c/ae97fff6495a8764bc0ef281cfe5444f701e527f
- https://git.kernel.org/stable/c/b51f5a310bd6888b90bb9546a8081215dcfe6fbe
- https://git.kernel.org/stable/c/f0afcec2129c166e61821d6ae097061155f01b12