Executive brief
A vulnerability in the Linux kernel's Wi-Fi management component could cause a system crash or instability. When a specific type of wireless connection (Multi-Link Operation) fails to initialize, the system may incorrectly handle internal data structures, leading to memory errors. This primarily affects systems with Wi-Fi 7 capabilities and could be used to disrupt network services or cause a denial of service.
Technical details
A use-after-free or double-free vulnerability exists in the mac80211 wireless framework within the Linux kernel. The issue is located in the 'ieee80211_prep_connection' function in 'net/mac80211/mlme.c'. When Multi-Link Operation (MLO) connection preparation fails, the interface resets to a non-MLD state, but the associated station information is not properly deleted. If debugfs is enabled, this leads to memory corruption because the virtual interface (vif) attempts to recreate its debugfs entries while stale references still exist. An attacker with local access could potentially trigger this failure to cause a kernel panic or denial of service. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.8, 6.9
Timeline
- 2026-05-05: patched: Initial patch authored by Johannes Berg
- 2026-05-28: disclosed: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/1c2b72ea89882aeb948340498391e69c58d466f1
- https://git.kernel.org/stable/c/283fc9e44ff5b5ac967439b4951b80bd4299f4e4
- https://git.kernel.org/stable/c/9e28654f79f443bca9b29ff3ae7cf18abfba58a0
- https://git.kernel.org/stable/c/afcbaed89cdc1a001b43270cbf5394bb4804270a
- https://git.kernel.org/stable/c/fe75fa1ac9a92990f7fc3d34b17808fd933071b2