CVE-2026-98195 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlegacy: fix broadcast stations deallocation
On the error path of __il4965_up(), il_dealloc_bcast_stations() clears only IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the same broadcast stations to be deallocated again by __il4965_down().
This can occur when RF_KILL is toggled during driver startup.
To fix clear the entire 'used' field, since we will not do any other operations on the station.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in the Linux kernel's iwlegacy wireless driver represents a critical resource management flaw within the initialization and teardown sequences of broadcast station handling. Specifically located in the __il4965_up function, this issue arises during the error path when the system attempts to clean up allocated resources after failing to fully initialize the hardware interface. The core technical defect lies in how il_dealloc_bcast_stations manages the state flags associated with broadcast stations. Instead of resetting all relevant status indicators, the code only clears the IL_STA_UCODE_ACTIVE flag while leaving the IL_STA_BCAST flag set. This incomplete cleanup creates a discrepancy between the actual allocation state and the recorded state within the driver's internal data structures.
This partial deallocation leads to severe operational consequences during subsequent hardware shutdown or reset operations. When __il4965_down is invoked, typically triggered by events such as toggling RF_KILL during driver startup, it relies on these flags to determine which stations require deallocation. Because the IL_STA_BCAST flag remains set despite the station being logically freed in the previous step, the system incorrectly identifies the broadcast station as still allocated and active. Consequently, __il4965_down attempts to deallocate an already freed resource. This double-free scenario can result in memory corruption, kernel panics, or undefined behavior that destabilizes the entire operating system environment. The specific trigger condition involving RF_KILL toggling highlights a race-like state inconsistency where hardware power states interact poorly with software lifecycle management routines.
From a classification perspective, this vulnerability aligns closely with CWE-415 Double Free and CWE-787 Out-of-bounds Write if the corrupted memory leads to heap corruption affecting adjacent structures. In terms of attack vectors, while primarily impacting system stability rather than direct privilege escalation in most contexts, such state inconsistencies can potentially be leveraged for Denial of Service attacks by repeatedly triggering the RF_KILL toggle during initialization phases. This maps to MITRE ATT&CK techniques related to resource exhaustion and disruption of service availability within network infrastructure components. The flaw underscores the importance of atomic state transitions and comprehensive cleanup procedures in kernel-space drivers where hardware interactions are frequent and timing-sensitive.
Mitigation strategies for this vulnerability involve applying the upstream Linux kernel patch that corrects the deallocation logic. The fix ensures that the entire used field associated with broadcast stations is cleared during error handling, thereby preventing any residual flags from triggering erroneous subsequent operations. System administrators should ensure their systems are updated to a version of the Linux kernel containing this specific iwlegacy driver correction. For environments where immediate patching is not feasible, monitoring for unusual system crashes or log entries related to wireless driver initialization failures can help identify affected instances. Long-term remediation requires rigorous code review practices focusing on state consistency checks during both success and error paths in hardware abstraction layers to prevent similar resource management errors in other drivers.