Linux Kernel EUVD-2026-53262

The vulnerability resides in the mac80211 layer of the Linux kernel - the software MAC implementation used by most Linux wireless drivers. The affected function, ieee80211_set_unsol_bcast_probe_resp(), manages unsolicited broadcast probe response (UBPR) templates used in 6 GHz WiFi AP mode (IEEE 802.11ax/Wi-Fi 6E). The bug is a classic error-path sequencing failure: kfree_rcu() is called on the old UBPR template object before the replacement allocation succeeds. RCU (Read-Copy-Update) deferred freeing means the old object is queued but not yet reclaimed; if kzalloc() returns NULL (ENOMEM), the link->u.ap.unsol_bcast_probe_resp pointer still references the already-queued memory. A subsequent AP teardown or configuration update re-queues the same rcu_head, causing a second kfree_rcu() on the same address - a double-free caught by KASAN in softirq context (rcu_core → rcu_free_sheaf → kmalloc-128 cache corruption). The fix mirrors the safe pattern used by ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon(): publish the new object first, then queue the old one for deferred freeing. Affected CPEs: cpe:2.3:a:linux:linux:* spanning commits from 3b1c256eb4aedfc71dd97d5951ccff824b41d628 to the respective fix commits.