CVE-2026-64568

A flaw was found in the Linux kernel's Wi-Fi subsystem. This vulnerability, a double free error, occurs when the system attempts to free a memory object twice during the handling of unsolicited broadcast probe responses. If a memory allocation fails in this process, the system can crash, leading to a Denial of Service (DoS).

A double free can occur in mac80211 unsol_bcast_probe_resp handling because ieee80211_set_unsol_bcast_probe_resp queued the old RCU object for freeing before the replacement allocation succeeded. If kzalloc fails, the stored pointer can still reference an object already queued for kfree_rcu, and a later update or AP teardown can queue the same rcu_head again. For the CVSS the PR:L is used because reliable triggering requires a local process with delegated wireless configuration capability such as CAP_NET_ADMIN rather than full system administration. The issue is not directly network reachable through Wi-Fi frames and is triggered through local control plane configuration. Impact is at least local denial of service via kernel crash and in the paranoid case may allow confidentiality or integrity impact because the primitive is kernel double free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.