CVE-2026-98195
wifi: iwlegacy: fix broadcast stations deallocation
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of __il4965_up(), il_dealloc_bcast_stations() clears only IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the same broadcast stations to be deallocated again by __il4965_down(). This can occur when RF_KILL is toggled during driver startup. To fix clear the entire 'used' field, since we will not do any other operations on the station.
INFO
Published Date :
Oct. 6, 2026, 9:18 a.m.
Last Modified :
Oct. 19, 2026, 10:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Ensure the entire 'used' field is cleared.
- Apply the provided kernel patch.
- Update the Linux kernel to the latest version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-98195.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-98195 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-98195
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-98195 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-98195 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 19, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98195.json">CVE-2026-98195</a> -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 06, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of __il4965_up(), il_dealloc_bcast_stations() clears only IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the same broadcast stations to be deallocated again by __il4965_down(). This can occur when RF_KILL is toggled during driver startup. To fix clear the entire 'used' field, since we will not do any other operations on the station. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98195.json">CVE-2026-98195</a> Added Reference https://git.kernel.org/stable/c/1d84c2a3de449aceb94ed79eaefecdf1bedb6468 Added Reference https://git.kernel.org/stable/c/275d474a4b4bd4e73b18b1452f12e78806a8843a Added Reference https://git.kernel.org/stable/c/526fdd45548e22eee50ee1062abd88269d9f32e0 Added Reference https://git.kernel.org/stable/c/55d34422c0d91436983028fd3c1546a1c2bee55f Added Reference https://git.kernel.org/stable/c/85d847ff71fe736cbc15ada321256818e630e205 Added Reference https://git.kernel.org/stable/c/a9176fe666af1730cab92350f9c8cf67ebf14439 Added Reference https://git.kernel.org/stable/c/b5526b780f8b297a76030410b96ba29153afb98f Added Reference https://git.kernel.org/stable/c/c9a116d691364cd7f59d8329b395adcaf826d5c6