CVE-2026-46125

Technical summary

This is a use-after-free and double-free vulnerability in the mac80211 WiFi subsystem (drivers/net/wireless/mac80211/) triggered during MLO (Multi-Link Operation) connection failure handling. When connection preparation fails for MLD (Multi-Link Device) operations, the kernel resets the virtual interface from MLD to non-MLD state and recreates debugfs entries. However, station objects associated with the removed MLD link are not properly deleted, leaving dangling references. If debugfs is enabled, subsequent access to these stale pointers causes a crash. The fix ensures that existing stations are explicitly removed when the vif transitions away from MLD mode following connection setup failure.

Business impact

Affected systems can experience denial of service through kernel panic or system lockup when WiFi connection setup fails under specific multi-link scenarios. In environments with debugfs enabled (common in development/testing systems), this becomes trivial to trigger. On production systems, exploiting this for information disclosure or privilege escalation would require deep knowledge of kernel internals and debugfs access, making it primarily a stability risk. The vulnerability impacts laptop/desktop systems and IoT devices relying on multi-link WiFi functionality.

Affected systems

Linux kernel systems with WiFi drivers using the mac80211 subsystem. Risk is elevated for systems where: (1) debugfs is compiled in and enabled, (2) multi-link WiFi (802.11be/Wi-Fi 7 or MLO-capable devices) hardware is present, (3) connection failures occur during MLD setup. This includes modern Linux distributions on laptops, embedded Linux systems, and potentially some network appliances.

Exploitability

Exploitability is **locally constrained** but non-trivial. An attacker must have network access to the affected system's WiFi and be able to trigger connection preparation failures—typically requiring the ability to control WiFi access point behavior or inject malformed connection frames. Triggering a crash via debugfs requires local file system access. The CVSS score of 8.8 reflects high impact (confidentiality, integrity, and availability) but the requirement for adjacent network access and lack of remote code execution capability means real-world exploitation is significantly more difficult than the score might suggest.

Remediation

Apply kernel patches that explicitly remove station references during MLD vif teardown on connection preparation failure. Vendors have released fixes in stable and development kernel branches. For systems not yet patched, disable debugfs at compile time if not operationally required, or restrict access to /sys/kernel/debug/ via mount options (debugfs_restrict_mount). For critical systems, disabling multi-link WiFi support at the driver or firmware level temporarily mitigates the issue pending patches.

Patch guidance

Check your kernel version against your distribution's security advisory (verify against the vendor advisory for exact patched versions—this is distribution-specific). Most major Linux distributions have released kernel updates; Ubuntu, Fedora, RHEL, and Debian/Stable all have patches available. Verify the patch commit hash in your kernel sources includes the mac80211 station removal fix. If using a custom kernel build, apply the upstream fix from the Linux kernel stable tree and recompile. Test in a non-production environment first, particularly if relying on WiFi connectivity.

Detection guidance

Monitor for kernel panic logs mentioning 'use-after-free' or 'double free' in debugfs (dmesg, journal). Systems with CONFIG_DEBUG_KASAN enabled will report detailed memory safety violations. Watch for unexpected WiFi disconnections paired with system instability during multi-link connection attempts. Enable kernel address sanitizer (KASAN) in test environments to surface the issue earlier. Review kernel logs for failed MLO connection setups on systems where this pattern precedes crashes.

Why prioritize this

Prioritize patching for development/test systems with debugfs enabled and multi-link WiFi hardware, and for production systems running kernel versions known to be vulnerable. While remote exploitation is not practical, the potential for denial of service combined with the wide deployment of Linux makes this a moderate-to-high priority for systematic patching. Defer lower-risk systems (single-link WiFi only, no debugfs) to regular maintenance windows.

Risk score, explained

CVSS 8.8 (HIGH) reflects: (1) high impact across confidentiality, integrity, and availability due to memory corruption potential; (2) adjacent network access requirement (AV:A) significantly reduces risk versus local or network; (3) no user interaction or special privileges required once network access is gained. The score appropriately penalizes the memory safety issue but the practical exploitability ceiling is meaningfully lower than the numeric score suggests due to environmental constraints (debugfs, MLO-capable hardware, connection failure timing).

Frequently asked questions