Skip to main content

Linux Kernel CVE-2026-64570

| EUVDEUVD-2026-53264 HIGH
2026-08-05 Linux GHSA-5gxw-5rpr-7mcv
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

CAP_NET_ADMIN required to configure FILS discovery on an AP interface (PR:H), and kzalloc() failure must be deliberately induced (AC:H); double-free grants full kernel memory impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:27 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Aug 05, 2026 - 09:01 EUVD
CVE Published
Aug 05, 2026 - 08:08 cve.org
HIGH 7.8
CVE Published
Aug 05, 2026 - 08:08 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix fils_discovery double free on alloc failure

ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.fils_discovery still points at the object already queued for freeing. A later update or AP teardown (ieee80211_stop_ap()) re-queues that same rcu_head; the second free is caught by KASAN when the RCU sheaf is processed in softirq:

BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850) Free of addr ffff88800c065280 by task swapper/0/0 ... __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940) rcu_free_sheaf (mm/slub.c:5850) rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-96 of size 96

Queue the old object for kfree_rcu() only after the new one is published, matching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().

AnalysisAI

Double-free memory corruption in the Linux kernel's mac80211 WiFi subsystem exposes systems running in WiFi 6 AP mode with FILS discovery configured to potential kernel heap corruption and privilege escalation. The flaw in ieee80211_set_fils_discovery() prematurely queues the old template for deferred freeing before confirming the new allocation succeeds; when kzalloc() fails, a stale pointer is retained and freed a second time upon AP teardown or reconfiguration. No public exploit identified at time of analysis; EPSS is 0.19% (8th percentile), consistent with the constrained exploitation prerequisites.

Technical ContextAI

The mac80211 subsystem handles 802.11 protocol state management in the Linux kernel, including management of AP-mode features. FILS (Fast Initial Link Setup) discovery, part of the 802.11ax (Wi-Fi 6) standard, enables out-of-band AP advertisement. The bug in ieee80211_set_fils_discovery() violates RCU memory management discipline: kfree_rcu() is called on the old fils_discovery template before the replacement kzalloc() is attempted. If kzalloc() returns NULL due to memory pressure, the function returns -ENOMEM but link->u.ap.fils_discovery still holds a pointer to the already-queued-for-freeing object. When ieee80211_stop_ap() or a subsequent configuration update is triggered, the same rcu_head is queued a second time - a double-free detected by KASAN during softirq processing in rcu_free_sheaf (mm/slub.c:5850). The root cause is CWE-415 (Double Free), corrected by deferring kfree_rcu() of the old object until after the new object is successfully published, consistent with patterns in ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon(). CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel release: 6.12.101, 6.18.42, 7.1.6, or 7.2-rc4, applying the relevant stable commit from git.kernel.org/stable. Major Linux distributions (Debian, Ubuntu, Red Hat, SUSE, Arch) will backport these fixes to their kernel packages; monitor vendor security channels for distribution-specific advisories. If immediate kernel upgrade is not feasible, restrict CAP_NET_ADMIN to only fully trusted accounts using capability-limiting tools (e.g., systemd CapabilityBoundingSet or seccomp policies), which narrows the local attack surface significantly but does not eliminate the underlying bug. Disabling FILS discovery on WiFi AP interfaces where Wi-Fi 6 out-of-band discovery is not operationally required eliminates the vulnerable code path entirely with no functional impact on most deployments; this can be done via hostapd configuration by removing the fils_discovery_min_interval directive. Systems not operating in WiFi AP mode are not exposed by this vulnerability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64570 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy