Detections
Analytics
CVE-2026-98704
high
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits WMM, HT, or VHT information, ieee80211_assoc_config_link() parses the cached BSS IEs and copies the missing element pointers out of that fallback parse. For a non-transmitted MBSSID profile those pointers refer to merged-profile storage owned by the parse object, and the fallback block frees that object at its end. The copied pointers are used afterwards to determine the operating channel, configure bandwidth, and apply HT capabilities. Keep the fallback parse result alive until association setup finishes. [reorder variable declaration]
References
https://git.kernel.org/stable/c/fb47973eecd869ab5662bb39002f6680536caa6c
https://git.kernel.org/stable/c/de77b0f68142147e74fac1c497dbe1f93daeeed9
https://git.kernel.org/stable/c/d0183cd1f6a2dba9e63be20af2f65093c9c8d121
https://git.kernel.org/stable/c/a10a2f80476d166fd81c361ec0319493671b694e
https://git.kernel.org/stable/c/64183344f6f29ed0cad33d6ec0e769aa5e31fb19
https://git.kernel.org/stable/c/409da4ad76d921b173ebb801e316023f74564239
https://git.kernel.org/stable/c/1d9644753d46c86b4e5c05bd6d9d35339ea27331
https://git.kernel.org/stable/c/0878594c5806dd29fa5e16cc026ce19158afdad2