FKIE_CVE-2026-98823

Vulnerability from fkie_nvd - Published: 2026-10-18 16:17 - Updated: 2026-10-30 13:21
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211_update_assoc_bss_entry() can pass such an entry to cfg80211_update_known_bss() when merging scan entries after a channel switch. Copying the borrowed beacon_ies into the associated entry gives the same allocation two owners. Releasing the group's beacon entry can then leave the associated entry pointing to freed IEs, which are freed again when that entry is released. Skip beacon IE replacement when the source entry belongs to a hidden group. Preserve probe-response processing, the subsequent metadata updates, and the existing rejection path for conflicting hidden beacon updates.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/00f83d39675adc12d56957a1f5e316812157e4d3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3c44f780d1738e9ddf438729f5ff6ceb45f9ded3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/49b66110a08e4f926f6393e938f226de2750a08b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5617d5328839003c91007ce906b4f100b43926e9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5f27581c176f84b52ec0ab9be7b500c10667ef60
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8f79f429dc87a4f21e4fcf9a4d3df9484ca9a294
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cc45f313d85533d647ce619326302aad6f797c14
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd7973a4130b0862be38d7e08cc0e874b3d99967
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00f83d39675adc12d56957a1f5e316812157e4d3",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "3c44f780d1738e9ddf438729f5ff6ceb45f9ded3",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "8f79f429dc87a4f21e4fcf9a4d3df9484ca9a294",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "5617d5328839003c91007ce906b4f100b43926e9",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "49b66110a08e4f926f6393e938f226de2750a08b",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "dd7973a4130b0862be38d7e08cc0e874b3d99967",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "5f27581c176f84b52ec0ab9be7b500c10667ef60",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "cc45f313d85533d647ce619326302aad6f797c14",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.273",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: preserve hidden-group beacon IE ownership\n\nA hidden-group probe-response entry borrows its beacon IEs from the\ngroup\u0027s beacon entry. cfg80211_update_assoc_bss_entry() can pass such\nan entry to cfg80211_update_known_bss() when merging scan entries\nafter a channel switch.\n\nCopying the borrowed beacon_ies into the associated entry gives the\nsame allocation two owners. Releasing the group\u0027s beacon entry can\nthen leave the associated entry pointing to freed IEs, which are\nfreed again when that entry is released.\n\nSkip beacon IE replacement when the source entry belongs to a hidden\ngroup. Preserve probe-response processing, the subsequent metadata\nupdates, and the existing rejection path for conflicting hidden\nbeacon updates."
    }
  ],
  "id": "CVE-2026-98823",
  "lastModified": "2026-10-30T13:21:29.160",
  "metrics": {},
  "published": "2026-10-18T16:17:36.533",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/00f83d39675adc12d56957a1f5e316812157e4d3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3c44f780d1738e9ddf438729f5ff6ceb45f9ded3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/49b66110a08e4f926f6393e938f226de2750a08b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5617d5328839003c91007ce906b4f100b43926e9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5f27581c176f84b52ec0ab9be7b500c10667ef60"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8f79f429dc87a4f21e4fcf9a4d3df9484ca9a294"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cc45f313d85533d647ce619326302aad6f797c14"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dd7973a4130b0862be38d7e08cc0e874b3d99967"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.