CVE-2026-98709wifi: mac80211: count only matching reservations in reserved switch
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating reservations too broadly. A link can still be assigned to the old channel context while holding a reservation that belongs to a different replacement operation. That can make the current replacement appear complete too early. If another link finalizes first, the function can free the WILL_BE_REPLACED chanctx while the unmatched link and driver still use it, leading to a use-after-free in later beacon generation. Require an in-place reservation to point at the current replacement context, and require the reserved and assigned contexts to be the matching replacement pair, before counting or moving the link.
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 12 days later
· 12 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < 4c4671a706d2d85442a30850abfada5377ffbbc8
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < 183cc72ae9467717afba8b8d194a558a6666cb53
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < b3d9f582f98e06070d5233b177b2899b693a01ec
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < 4ae6ed5b6074df5f3da05fd74c40bb24c5c9b41d
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < d31f655e44631891788ca67018ec5e1ed1c7de86
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < 03525b632908b049f4d04cc8a71cdff2329589cf
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < 5cc54a000960bc88f8c58940164dca0e601ab39c
- affected 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f – < 437f3727b4fd715266c296435c116288f82666fd
- affected 3.17
- unaffected < 3.17
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.113 – ≤ 6.12.*
- unaffected 6.18.56 – ≤ 6.18.*
- unaffected 7.2.10 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/4c4671a706d2d85442a30850abfada5377ffbbc8 (opens in a new tab)
- https://git.kernel.org/stable/c/183cc72ae9467717afba8b8d194a558a6666cb53 (opens in a new tab)
- https://git.kernel.org/stable/c/b3d9f582f98e06070d5233b177b2899b693a01ec (opens in a new tab)
- https://git.kernel.org/stable/c/4ae6ed5b6074df5f3da05fd74c40bb24c5c9b41d (opens in a new tab)
- https://git.kernel.org/stable/c/d31f655e44631891788ca67018ec5e1ed1c7de86 (opens in a new tab)
- https://git.kernel.org/stable/c/03525b632908b049f4d04cc8a71cdff2329589cf (opens in a new tab)
- https://git.kernel.org/stable/c/5cc54a000960bc88f8c58940164dca0e601ab39c (opens in a new tab)
- https://git.kernel.org/stable/c/437f3727b4fd715266c296435c116288f82666fd (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-103963 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98709)Record last updated .