CVE-2026-64574

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mac80211: tear down new links on vif update error path<br /> <br /> When ieee80211_vif_update_links() adds new links it allocates a link<br /> container for each and calls ieee80211_link_init() (which registers the<br /> per-link debugfs files with file-&gt;private_data pointing into the container)<br /> and ieee80211_link_setup(). If the subsequent drv_change_vif_links() fails,<br /> the error path restores the old pointers and jumps to &amp;#39;free&amp;#39;, which frees<br /> the new containers but never removes their debugfs entries or stops the<br /> links. The debugfs files survive with file-&gt;private_data dangling at the<br /> freed container, so a later open()+read() (e.g. link-1/txpower)<br /> dereferences freed memory in ieee80211_if_read_link(), a use-after-free.<br /> <br /> The removal path already dismantles links correctly via<br /> ieee80211_tear_down_links(), which removes each link&amp;#39;s keys and debugfs<br /> entries and calls ieee80211_link_stop(); the add path on the error branch<br /> does not. Commit be1ba9ed221f ("wifi: mac80211: avoid weird state in error<br /> path") hardened this same error path for the link-removal case<br /> (new_links == 0) but left the newly-added links&amp;#39; teardown unaddressed.<br /> <br /> drv_change_vif_links() can fail at runtime on MLO drivers (internal<br /> allocation / queue / firmware command failures).<br /> <br /> Remove the new links&amp;#39; debugfs entries and stop them before freeing.<br /> <br /> BUG: KASAN: slab-use-after-free in ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127)<br /> Read of size 8 at addr ffff888011290000 by task exploit/145<br /> Call Trace:<br /> ...<br /> ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127)<br /> short_proxy_read (fs/debugfs/file.c:373)<br /> vfs_read (fs/read_write.c:572)<br /> ksys_read (fs/read_write.c:716)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)<br /> ...<br /> Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a<br /> RIP: 0010:ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127)<br /> Kernel panic - not syncing: Fatal exception