CVE-2026-64568 in Linux
Summary
by MITRE • 08/05/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.unsol_bcast_probe_resp still points at the object already queued for freeing. A later update or AP teardown re-queues that same rcu_head; the second free is caught by KASAN when the RCU sheaf is processed in softirq:
BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850) Free of addr ffff88800d06f300 by task exploit/145 ... __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940) rcu_free_sheaf (mm/slub.c:5850) rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-128 of size 128
Queue the old object for kfree_rcu() only after the new one is published, matching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability resides within the linux kernel's mac80211 subsystem which handles wireless networking operations for ieee 80211 devices. The flaw occurs in the ieee80211_set_unsol_bcast_probe_resp() function where improper memory management leads to a double free condition during allocation failure scenarios. The issue stems from the function's execution flow where kfree_rcu() is called on the existing template before attempting to allocate a new one, creating a race condition that can result in memory corruption.
The technical implementation flaw involves the sequence of operations within the wireless subsystem's probe response handling mechanism. When the kzalloc() allocation for the replacement template fails with -ENOMEM, the old template remains queued for RCU freeing while the link structure still points to the same memory location. This creates a scenario where the same memory address gets scheduled for deallocation twice during subsequent RCU processing in softirq context, triggering KASAN's double-free detection mechanism.
The operational impact of this vulnerability extends beyond simple memory corruption as it represents a potential vector for denial of service attacks or privilege escalation within wireless networking contexts. The double free condition manifests through kernel memory management subsystems where the kmalloc-128 cache experiences a corrupted free operation, potentially leading to system instability or exploitation of memory layout weaknesses. This flaw specifically affects wireless access point functionality when handling unsolicited broadcast probe responses in ieee 80211 networks.
The mitigation strategy involves reordering the memory management operations to ensure proper sequencing where old objects are only queued for kfree_rcu() after successful publication of new templates, aligning with established patterns used in similar functions like ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon(). This approach follows standard practices for atomic updates in concurrent systems and prevents the race condition that leads to double-free conditions. The fix addresses the underlying issue by maintaining memory consistency during allocation failures and adheres to the principle of releasing resources only after successful replacement operations, which is consistent with security best practices outlined in common vulnerability patterns and kernel memory management standards.