Look up another CVE · open CVE-2026-64574 in the interactive tracker
CVE-2026-64574
wifi: mac80211: tear down new links on vif update error path
Published 2026-08-05 (2 months ago) by the Linux kernel CNA. Subsystem net/mac80211. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64574 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6415-1 · 2026-08-06 · text | 6.12.101-1 | Update the kernel and reboot. DSA-6415-1 shipped the fix on 2026-08-06, in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When ieee80211_vif_update_links() adds new links it allocates a link container for each and calls ieee80211_link_init() (which registers the per-link debugfs files with file->private_data pointing into the container) and ieee80211_link_setup(). If the subsequent drv_change_vif_links() fails, the error path restores the old pointers and jumps to 'free', which frees the new containers but never removes their debugfs entries or stops the links. The debugfs files survive with file->private_data dangling at the freed container, so a later open()+read() (e.g. link-1/txpower) dereferences freed memory in ieee80211_if_read_link(), a use-after-free. The removal path already dismantles links correctly via ieee80211_tear_down_links(), which removes each link's keys and debugfs entries and calls ieee80211_link_stop(); the add path on the error branch does not. Commit be1ba9ed221f ("wifi: mac80211: avoid weird state in error path") hardened this same error path for the link-removal case (new_links == 0) but left the newly-added links' teardown unaddressed. drv_change_vif_links() can fail at runtime on MLO drivers (internal allocation / queue / firmware command failures). Remove the new links' debugfs entries and stop them before freeing. BUG: KASAN: slab-use-after-free in ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) Read of size 8 at addr ffff888011290000 by task exploit/145 Call Trace: ... ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) short_proxy_read (fs/debugfs/file.c:373) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) ... Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a RIP: 0010:ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) Kernel panic - not syncing: Fatal exception
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/mac80211/link.c
- What this is
- MAC80211MAINTAINERS section matched on net/mac80211/ · linux-wireless@vger.kernel.org · Maintained
- Kernel module
- mac80211
Check it on the machine
grep -w CONFIG_MAC80211 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w mac80211Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_MAC80211
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-05 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/mac80211
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.4 | 6.6.148 | 329589417214 |
| 6.4 | 6.12.101 | c57d97f38130 |
| 6.4 | 6.18.42 | 0f7eaeb950ad |
| 6.4 | 7.1.6 | 901a73523e09 |
| 6.4 | 7.2 | 952c02b33f56 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
| DSA-6415-1 | 2026-08-06 | trixie 6.12.101-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached via local nl80211 link updates (NL80211_CMD_ADD_LINK / ieee80211_vif_set_links → ieee80211_vif_update_links) and completed by a local debugfs open/read of the dangling per-link file, not by processing over-the-air frames alone.
- AC:LAttack complexity, low
- An attacker can reliably force the error path by adding an MLO AP link whose MAC duplicates an existing link so ieee80211_check_dup_link_addrs() fails after ieee80211_link_init() already registered debugfs, then read the leftover file; no attacker-independent condition is required.
- PR:LPrivileges required, low
- NL80211_CMD_ADD_LINK is gated by GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN in the netns user_ns), which an unprivileged user can obtain via user/net namespaces or common WiFi management paths, so privileges are Low rather than init-namespace root.
- UI:NUser interaction, none
- The attacker issues the nl80211 ADD_LINK sequence and the subsequent debugfs read themselves; no separate victim action such as mounting a filesystem or opening a hostile file is required.
- S:UScope, unchanged
- The use-after-free and resulting kernel memory corruption stay within the host mac80211/debugfs authority and do not cross a VM, IOMMU, or other separate security boundary.
- C:HConfidentiality impact, high
- Dangling debugfs file->private_data points at the freed link_container; reading it (ieee80211_if_read_link) is a slab use-after-free that can be reclaimed/sprayed for arbitrary kernel memory disclosure.
- I:HIntegrity impact, high
- The same freed link object is the debugfs private_data for readable/writable per-link files, so UAF reclaim enables attacker-controlled structure contents and control-flow hijack consistent with kernel UAF integrity High.
- A:HAvailability impact, high
- The fix commit’s KASAN slab-use-after-free in ieee80211_if_read_link leads to a general protection fault and kernel panic, so availability impact is High even without full exploitation.