---
id: CVE-2026-98709
title: 'wifi: mac80211: count only matching reservations in reserved switch'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: count only matching reservations in reserved switch

  ieee80211_vif_use_reserved_switch() validates a replacement by counting
  assigned links on ctx->repl…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f <
    d31f655e44631891788ca67018ec5e1ed1c7de86
  - >-
    Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f <
    03525b632908b049f4d04cc8a71cdff2329589cf
  - >-
    Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f <
    5cc54a000960bc88f8c58940164dca0e601ab39c
  - >-
    Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f <
    437f3727b4fd715266c296435c116288f82666fd
  - Linux 3.17
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:46:39.290Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98709'
references:
  - url: 'https://git.kernel.org/stable/c/d31f655e44631891788ca67018ec5e1ed1c7de86'
  - url: 'https://git.kernel.org/stable/c/03525b632908b049f4d04cc8a71cdff2329589cf'
  - url: 'https://git.kernel.org/stable/c/5cc54a000960bc88f8c58940164dca0e601ab39c'
  - url: 'https://git.kernel.org/stable/c/437f3727b4fd715266c296435c116288f82666fd'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.512Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: count only matching reservations in reserved switch

ieee80211_vif_use_reserved_switch() validates a replacement by counting
assigned links on ctx->replace_ctx and treating reservations too
broadly. A link can still be assigned to the old channel context while
holding a reservation that belongs to a different replacement
operation.

That can make the current replacement appear complete too early. If
another link finalizes first, the function can free the
WILL_BE_REPLACED chanctx while the unmatched link and driver still use
it, leading to a use-after-free in later beacon generation.

Require an in-place reservation to point at the current replacement
context, and require the reserved and assigned contexts to be the
matching replacement pair, before counting or moving the link.

## Affected

- `Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f < d31f655e44631891788ca67018ec5e1ed1c7de86`
- `Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f < 03525b632908b049f4d04cc8a71cdff2329589cf`
- `Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f < 5cc54a000960bc88f8c58940164dca0e601ab39c`
- `Linux >= 5bcae31d9cb1ebfad3ad5a3eea04c8cdc329a04f < 437f3727b4fd715266c296435c116288f82666fd`
- `Linux 3.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.