EUVD-2026-93326
GHSA-cxwv-25fr-82vv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local wireless-management capability
-
DeliveryStart scan then down the interface
-
ExploitWin async cancellation race in cfg80211
-
ExecutionTrigger use-after-free in scan_done()
-
ImpactCorrupt kernel memory / escalate privileges
Vulnerability Assessment
| Exploitation Conditions | Requires local access on a system running the Linux cfg80211 wireless stack with an actual Wi-Fi device/driver, plus the capability (typically CAP_NET_ADMIN) to initiate a scan and bring the interface down. Exploitation hinges on a narrow timing window: the interface must go down while a scan is still running so the asynchronous cancellation leaves the driver believing it still owns the freed scan request. Limiting factors: no remote vector (AV:L), the race must be won reliably, the host must have wireless hardware/driver using cfg80211, and the privilege to manage the interface is itself a gate - so default server deployments without Wi-Fi management are not meaningfully exposed. |
| Impact | Signals align toward a genuine-but-not-urgent local kernel flaw. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8) reflects a local, low-privilege use-after-free with full confidentiality/integrity/availability impact - consistent with the description of a UAF in scan_done() within cfg80211. EPSS is low (0.17%, 6th percentile) and the CVE is NOT in CISA KEV, with no public exploit indicated, so this is not a mass-exploitation priority. Note a tension in the input: the supplied CVSS scores AC:L, but the root cause is an asynchronous cancellation race (scan running while the interface goes down), which realistically implies a timing-dependent condition (AC:H) rather than straight-line low complexity - verify complexity assumptions. Also, initiating scans and bringing a wireless interface down generally requires network-admin capability, so true PR:N is unlikely; the input's PR:L is reasonable or arguably higher. Bottom line: a credible local privilege-escalation / kernel-memory-corruption bug worthy of patching in the normal cycle, but not an emergency given low EPSS, no KEV, and no observed exploit. |
| Exploit ScenarioDerived | A local user with the ability to manage a Wi-Fi interface starts a scan and then brings the interface down mid-scan, racing cfg80211's asynchronous scan cancellation so the driver still believes it owns the freed scan request. Hitting the window triggers a use-after-free in scan_done(), which an attacker can attempt to groom into kernel memory corruption and privilege escalation. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A use-after-free in the Linux kernel's cfg80211 wireless configuration subsystem can be triggered locally when a network interface is taken down while a scan is still running, causing cfg80211 to free a scan request that the Wi-Fi driver still believes it owns. Successful exploitation corrupts kernel memory reachable at scan completion (scan_done()), yielding high confidentiality, integrity, and availability impact, though the attacker must already hold local privileges sufficient to manage the wireless interface (CVSS PR:L) and must win a narrow asynchronous-cancellation race (assessed AC:H, versus the vendor's AC:L). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (6th percentile).
RemediationAI
Apply the vendor fix by updating to a Linux kernel build that includes the cfg80211 scan-request ownership fix - per the input data, stable releases 6.18.54 and 7.2.8 (and 7.3-rc4) carry the change, corresponding to upstream commits e8c75736cfd0c6c87562cda2312e3fe5e2227955, cf6da29d17994865f73ca70976495ea856909c63, and dab68a74e90b8e07f08ed9deaa5884857a3cfe89 (see https://git.kernel.org/stable/c/e8c75736cfd0c6c87562cda2312e3fe5e2227955 and the sibling links, plus https://nvd.nist.gov/vuln/detail/CVE-2026-98341). No vendor-released patch version outside these branches is independently confirmed, so distribution backports should be verified against your kernel package changelog. Until patched, the practical compensating controls follow directly from the assessed prerequisites: restrict CAP_NET_ADMIN and wireless interface management to trusted local users (drops the exploitable privilege gate but hinders legitimate network configuration tooling), and avoid automation or orchestration that tears down Wi-Fi interfaces while scans are in flight (reduces, but cannot guarantee elimination of, the race window since it is timing-dependent and can still occur under normal administrative actions). Disabling the wireless stack entirely or blacklisting the affected driver removes the attack surface at the cost of losing Wi-Fi connectivity, which is acceptable only for hosts that do not require wireless networking; because the vector is strictly local (AV:L) and requires a wireless device, network-edge filtering provides no mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cfg80211 is the kernel's wireless configuration layer that sits between nl80211/userspace (e.g., wpa_supplicant, iw, NetworkManager) and the individual MAC80211-based Wi-Fi drivers. Scan requests are typically owned by the driver until completion, but cfg80211 also tracks them so it can complete results to userspace. The flaw arises because scan cancellation is intended to be asynchronous: when an interface is brought down (a netdev notifier event) during an active scan, cfg80211 completes the scan towards userspace and frees the scan request object, while the driver still believes it owns that request. The WARN_ON() checks in the netdev notifier that were supposed to catch this state are not actually avoidable in the intended architecture, so they fire and a use-after-free occurs in the scan completion path (scan_done()). The upstream fix removes the warnings and instead explicitly tracks that the driver still considers the request its own, deferring the free until the driver's completion arrives if the request was already cancelled. This is a classic CWE-416 use-after-free rooted in an ownership/lifetime mismatch between two components, and it is consistent with the input CPE entries for the Linux kernel (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only trigger (AV:L); winning the asynchronous scan-cancellation race is timing-dependent (AC:H); starting scans/downing the interface needs network-admin capability (PR:L); UAF enables kernel memory corruption so C/I/A all High.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
3DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't free driver-owned scan requests
When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it owns the request, since the cancellation is (intended to be) asynchronous.
The WARN_ON() in the netdev notifier was meant to catch this, but it's not actually avoidable, so it triggers and we get a UAF in scan_done().
There doesn't seem to be a great way around it, so just track that the driver is still convinced it owns the request, and then just free it on completion if it was already cancelled. Also remove the warnings since they can trigger in the intended architecture.
Executive ViewAI
A memory-corruption flaw in the Linux kernel's Wi-Fi configuration subsystem (cfg80211) affects unpatched Linux servers, workstations, and appliances that load the wireless stack, and could allow a user who already has local access to escalate to full kernel control. Because no vendor fix currently exists, every Linux estate running wireless drivers remains exposed until either a kernel update ships or the wireless stack is removed from hosts that do not need it. Leadership should care because a kernel-level compromise of this kind defeats endpoint and container isolation on the affected host, and the exposure window is open-ended.
No vendor-released patch identified at time of analysis. Interim mitigations: unload and blacklist cfg80211/mac80211 and vendor Wi-Fi driver modules on hosts that do not need wireless functionality; restrict local accounts holding CAP_NET_ADMIN or the ability to bring interfaces down and initiate scans; monitor kernel oops/panic and use-after-free telemetry for signs of exploitation attempts; segment wireless-capable Linux hosts from high-value network segments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB