CVE-2026-64574

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. When new Wi-Fi links are added, an error in the update process can cause debugfs entries to point to memory that has already been freed. A local attacker can exploit this use-after-free vulnerability by accessing these dangling debugfs entries, which can lead to a system crash and a denial of service.

A moderate-impact use-after-free flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When ieee80211_vif_update_links() adds new Wi-Fi links and the subsequent drv_change_vif_links() driver callback fails, which can occur at runtime on multi-link operation (MLO) capable drivers due to internal allocation, queue, or firmware command failures, the error path frees the newly allocated link containers without removing their per-link debugfs entries or stopping the links. The surviving debugfs files keep file->private_data pointing into the freed memory, so a local attacker who can read one of these dangling debugfs entries (for example link-1/txpower) triggers a use-after-free read in ieee80211_if_read_link(), causing a kernel panic and a denial of service.

The affected scope covers the kernel and kernel-rt components of Red Hat Enterprise Linux 8 (8.10 update stream), Red Hat Enterprise Linux 9 (9.4, 9.6, 9.8, and 9.9 streams), Red Hat Enterprise Linux 10 (10.0, 10.2, and 10.3 streams), and Red Hat In-Vehicle OS 2, including its kernel-ivos-qualcomm component; in these streams the fix is currently deferred. Earlier Red Hat Enterprise Linux streams (RHEL 6 ELS, RHEL 7 ELS, and the RHEL 8.4, 8.6, 8.8, and RHEL 9.2 update streams) are not affected because the code that registers the per-link debugfs data this flaw depends on is not present in those versions.

Because the fix is deferred, a residual risk remains: a local user who can access a dangling per-link debugfs entry left behind after a failed Wi-Fi link update on an MLO-capable driver could crash the kernel and cause denial of service. Exploitability is limited, since triggering the flaw requires local access, a runtime driver failure during a link update, and read access to the Wi-Fi debugfs files, which is typically restricted to privileged users, and the demonstrated impact is a system crash rather than loss of confidentiality or integrity.

The upstream CVE record rates this flaw Important (CVSS 3.1 score 7.8), while Red Hat rates it Moderate (CVSS 3.1 score 5.5). Red Hat's lower rating reflects that exploitation requires local access, depends on a rare error path in MLO-capable Wi-Fi drivers, and results in denial of service with no established confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.