[CVE-2026-98704][MODERATE 7.0] wifi: mac80211: keep fallback association elements alive

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-98704
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: wifi: mac80211: keep fallback association elements alive
Commit: 1d9644753d46c86b4e5c05bd6d9d35339ea27331
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1d9644753d46c86b4e5c05bd6d9d35339ea27331
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98704
Analysis date: Fri, 23 Oct 2026 20:04:55 -0400
ActionableScore: 6
ActionableScore lower bound: unknown
Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review
Manual review required: YES

Summary:
A malicious Wi-Fi access point can trigger an active-path use-after-free read in mac80211 during association, with stale MBSSID element pointers later consumed during channel, bandwidth, and HT configuration.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98704 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98704

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE 7.0
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-98704	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-98704 CHECK WITH IMPACT FROM ORIG NN IMPORTANT | AEGIS IMPACT MODERATE_KPANIC AEGIS_AS=4 LEGACY=MODERATE_KPANIC RESULT=SAME (final reconciliation agrees; DECISION: both MODERATE_KPANIC)	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H';*CWE-416;*CWE-672;CWE-825;Other CVSS 'AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H';BEST CVSS score: '6.4';DESCR 'A use-after-free read in mac80211 occurs when fallback association element pointers from a non-transmitted MBSSID profile remain in use after their merged profile parse storage is freed. An adjacent attacker controlling a Wi-Fi access point can expose the path by omitting WMM, HT, or VHT information from an association response, causing mac80211 to obtain the missing pointers from cached BSS IEs. The stale pointers are later read while selecting the operating channel, configuring bandwidth, and applying HT capabilities. This can cause invalid kernel memory reads, incorrect association state, or a kernel crash. For the CVSS the PR:N value is used because the attacker only needs control of a reachable Wi-Fi access point and does not require an account or privileges on the affected client. The base score uses UI:R because the client must initiate association. The paranoid score allows UI:N for automatic association or reconnection and uses C:L and I:L because stale heap contents may influence later parsing, although no information disclosure or write primitive is demonstrated. Impact is at least an adjacent denial of service and in the worst still defensible case may include limited confidentiality or integrity impact from use of reused kernel memory. Automated impact decision path. The original SimpleNet classifier selected IMPORTANT. The primary LLM estimated paranoid CVSS 6.4 and the production ActionableScore returned 6 with recommendation Actionable Moderate / Strong Important candidate requiring manual review. The production rules then evaluated CVSS thresholds and ActionableScore thresholds. Recorded rule transitions were CVSS and initial triage stage IMPORTANT to IMPORTANT because the CVSS score, vector or bug class threshold rule was applied. KP and FD specialist checks stage IMPORTANT to MODERATE_KPANIC because FD false positive review allowed a downgrade. The legacy KP specialist produced a review artifact and its decision was processed by the applicable KP rules. The legacy FD or DH downgrade specialist produced a review artifact and its decision was processed by the applicable downgrade and preservation rules. Exact triggered rule markers were LOWERED_FROM_HIGH_BASED_ON_GUESSCVSS and INCREASED_TO_HIGH_BASED_ON_GUESSCVSS and DECREASED_TO_MODERATE7_BASED_ON_FALSEPOSCHECKOFDH. The independent weaker Aegis shadow evaluated CVSS 3.5 and ActionableScore 4 with primitive class CLASS_B and manual review REQUIRED. Its independently reconciled impact was MODERATE_KPANIC. The shadow agreed with the final production impact and aggregation did not change that impact. The final reported impact is MODERATE_KPANIC.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 6)	MAYBE	REMOTE DANGER UAF KPANIC  KPANIC LOWERED_FROM_HIGH_BASED_ON_GUESSCVSS  KPANIC INCREASED_TO_HIGH_BASED_ON_GUESSCVSS DECREASED_TO_MODERATE7_BASED_ON_FALSEPOSCHECKOFDH	-	-	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=6
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=NO
NamespaceScopedPrivilege=NO
ImportantCandidate=YES
ManualReview=REQUIRED
AutoDowngradeAllowed=NO
RequiresHostUID0=NO
AuthorizationDecisionBypass=NO
ProtectedResourceImpact=NONE
B4PendingReview=NO
B4PendingConfirmed=NO

1. ActionableScore

* Raw conservative score: 6
* Conservative score: 6
* Raw paranoid score: 6
* Paranoid score: 6
* No floor or cap was applied.
* Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**::

2. Signal breakdown

Positive signals:

* +2 Real UAF. Pointers copied from the fallback `bss_elems` parse refer to merged-profile storage that is freed before the pointers are subsequently dereferenced.
* +2 Direct network-adjacent trigger. A malicious or attacker-controlled Wi-Fi AP can supply a non-transmitted MBSSID profile and omit WMM, HT, or VHT elements, causing the vulnerable fallback path during association.
* +1 Attacker-influenced active-object state and repeatable lifetime sequence. The AP controls relevant association and cached BSS IE contents and can expose the allocation, free, and stale-use sequence through repeated association attempts.
* +1 Structured stale-object exploitation leverage. The stale pointers are not used only by cleanup. They remain active inputs to operating-channel selection, bandwidth configuration, and HT capability processing.

Non-awarded signals:

* +0 Reliable kernel crash. Invalid freed-memory reads can plausibly cause an Oops, but the supplied evidence does not establish a deterministic or reliable host crash.
* +0 Strong exploitation leverage. Controlled reclaim, attacker-shaped replacement storage, callback control, arbitrary read, and arbitrary write are not demonstrated.
* +0 Confidentiality. No path returning stale kernel data to the AP or userspace is established.
* +0 Integrity bonus. Incorrect association configuration is plausible, but modification of protected kernel state or another principal's data is not established.
* +0 Repeated release or refcount mutation. No second `put`, `free`, or refcount operation through the dangling reference exists.
* +0 Authorization bypass. The defect does not change a mandatory authorization decision from DENY to ALLOW.
* +0 B5-R, B3-PENDING, and B4-PENDING. There is no retry-accumulated OOB write, shared-backing write, or authorization-state bypass.
* No race, privilege, rare-subsystem, or hardware penalty was applied.

3. Reachability analysis

The evaluated attacker controls a Wi-Fi access point within radio range and provides a non-transmitted MBSSID profile with selected association elements omitted. The client must associate with that AP, but this may occur through either user-selected association or automatic reconnection to a recognized or spoofed network.

The attacker does not need local execution, host UID 0, a kernel capability, or host-administrator access. No user-namespace or network-namespace capability is part of the trigger, so the complete path is not namespace-privilege dependent. A functioning mac80211 Wi-Fi client and an association attempt are required, but Wi-Fi hardware is not sufficiently rare to justify a hardware penalty.

The sequence is deterministic lifetime misuse rather than a timing race. Repeated association attempts are practical, although control over post-free heap replacement is not established.

4. Primitive and severity interpretation

The exact primitive is a heap use-after-free read. `bss_elems` owns merged-profile storage containing fallback association elements. Element pointers escape from that parse result, `bss_elems` is freed, and the escaped pointers are subsequently dereferenced.

This is an active structured-object lifetime violation rather than fixed stale storage or a cleanup-only dereference. The stale data participates in channel selection, bandwidth setup, and HT capability processing. The patch does not establish a write through the stale pointer, controlled heap reclaim, disclosure, repeated lifetime mutation, or privilege escalation.

PrimitiveClass is CLASS_B because a real active-path UAF exists and attacker-influenced structured data continues into privileged kernel processing, but no CLASS_A exploitation primitive is demonstrated. ImportantCandidate is YES because the network-adjacent attacker influence and nontrivial post-free consumption require Important-versus-Moderate review. AutoDowngradeAllowed is NO because automatically treating this as an ordinary crash-only issue would discard unresolved exploitation leverage associated with attacker-influenced stale association state.

The demonstrated consequence is an invalid kernel memory read and potentially incorrect Wi-Fi association state. A kernel crash is plausible but not proven reliable. Stronger confidentiality, integrity, arbitrary kernel access, or privilege-escalation consequences remain speculative.

5. One-sentence report phrase

A malicious Wi-Fi access point can trigger an active-path use-after-free read in mac80211 during association, with stale MBSSID element pointers later consumed during channel, bandwidth, and HT configuration.

6. Manual review recommendation

MANUAL CHECK REQUIRED

A real network-adjacent UAF affects attacker-influenced structured state that remains active in later kernel association processing, while the consequences of heap reuse beyond invalid reads remain unresolved.

7. Call-site confidence

Call-site confidence: high

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: wifi: mac80211: keep fallback association elements alive
Commit: 1d9644753d46c86b4e5c05bd6d9d35339ea27331
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1d9644753d46c86b4e5c05bd6d9d35339ea27331

Commit description:

Associating to a non-transmitted MBSSID profile reads freed memory while
determining the operating channel and applying HT capabilities.

When an association response omits WMM, HT, or VHT information,
ieee80211_assoc_config_link() parses the cached BSS IEs and copies the
missing element pointers out of that fallback parse. For a
non-transmitted MBSSID profile those pointers refer to merged-profile
storage owned by the parse object, and the fallback block frees that
object at its end. The copied pointers are used afterwards to determine
the operating channel, configure bandwidth, and apply HT capabilities.

Keep the fallback parse result alive until association setup finishes.

Fixes: 5023b14 ("mac80211: support profile split between elements")
Cc: stable@kernel.org
Assisted-by: LLM sparse kasan
[reorder variable declaration]
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Changed files:
  net/mac80211/mlme.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1d9644753d46c86b4e5c05bd6d9d35339ea27331

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98704 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98704

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
  The Best / paranoid CVSS score: 6.4

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 6

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).