CVE-2026-98823

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: preserve hidden-group beacon IE ownership

A hidden-group probe-response entry borrows its beacon IEs from the

group's beacon entry. cfg80211_update_assoc_bss_entry() can pass such

an entry to cfg80211_update_known_bss() when merging scan entries

after a channel switch.

Copying the borrowed beacon_ies into the associated entry gives the

same allocation two owners. Releasing the group's beacon entry can

then leave the associated entry pointing to freed IEs, which are

freed again when that entry is released.

Skip beacon IE replacement when the source entry belongs to a hidden

group. Preserve probe-response processing, the subsequent metadata

updates, and the existing rejection path for conflicting hidden

beacon updates.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References