CVE-2026-98341

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Nothing from the air causes this. It needs the interface taken down during a running scan, which is done locally: link-down/dev_close to the NETDEV_DOWN branch of cfg80211_netdev_notifier_call(), or a /dev/rfkill soft-block via cfg80211_rfkill_set_block()->cfg80211_shutdown_all_interfaces(). A WiFi peer cannot cause either, so the vector is local.

AC:LAttack complexity, low

The attacker causes both sides: start a scan (nl80211 TRIGGER_SCAN or a NetworkManager scan request), then block rfkill or bring the link down. With hw_scan drivers ieee80211_scan_cancel() only calls drv_cancel_hw_scan() and returns. ___cfg80211_scan_done() frees the request before the driver's async completion calls cfg80211_scan_done(), so the window is the whole multi-second scan.

PR:LPrivileges required, low

Direct nl80211/rtnetlink control of an init_net wiphy needs CAP_NET_ADMIN. But on standard systemd desktops the active console user can write /dev/rfkill (uaccess rule), and an rfkill block runs dev_close() into the freeing notifier. That user can also request scans, so an ordinary local user is enough.

UI:NUser interaction, none

The attacker does both steps (start the scan, then rfkill-block or take the link down) without any action from another user.

S:UScope, unchanged

The UAF corrupts kernel heap memory under the same kernel authority. No VM, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

The freed cfg80211_scan_request_int is a kmalloc object whose size the attacker sets through the scan's channel count and IE length. The driver and cfg80211_scan_done() later read it (info, wdev, notified), so a reclaimed object can be used to leak kernel memory.

I:HIntegrity impact, high

cfg80211_scan_done() writes into the freed request (intreq->info, notified) and follows req.wdev from it. Reclaiming the slot with attacker-controlled data gives a write and pointer-confusion primitive that could be used for privilege escalation.

A:HAvailability impact, high

The use-after-free in cfg80211_scan_done() reached from the mac80211 scan completion work (syzbot report) gives a KASAN splat or kernel oops, and it can be repeated at will.