PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46125 Linux CVE debrief

A use-after-free/double-free vulnerability exists in the Linux kernel's mac80211 Wi-Fi subsystem when Multi-Link Operation (MLO) connection preparation fails. The issue occurs because the interface is reset to non-MLD state without properly removing the associated station, which is tied to the virtual interface link being removed. When debugfs is enabled, this leads to memory corruption as the virtual interface recreates its entire debugfs structure while stale station references persist. The vulnerability is triggered during failed MLO connection setup, where the station cleanup path was incomplete for the error handling case.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-15
Advisory published
2026-05-28
Advisory updated
2026-07-15

Who should care

Organizations running Linux systems with Wi-Fi 7 (802.11be) hardware and MLO enabled, particularly those with debugfs enabled in production kernel builds. Cloud providers and edge computing deployments using wireless connectivity should monitor for kernel updates.

Technical summary

The mac80211 subsystem in the Linux kernel fails to properly clean up station state when Multi-Link Operation (MLO) connection preparation fails. During MLO setup failure, the virtual interface is reset from MLD to non-MLD state, but the associated station—linked to the virtual interface's link—is not removed. This leaves a dangling station reference that causes use-after-free or double-free conditions when debugfs recreates its structures. The fix ensures station deletion occurs during the connection preparation failure path, matching the cleanup behavior for successfully created stations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits when available from your Linux distribution
  • Monitor distribution security advisories for backported fixes to supported kernel versions
  • If running custom kernel builds with debugfs enabled, prioritize patching due to elevated corruption risk
  • Review systems using Wi-Fi 7 (802.11be) MLO capabilities as the vulnerable code path is specific to MLO connection handling
  • Consider disabling debugfs in production environments if not required for diagnostics to reduce attack surface

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Fix commits identified in kernel.org stable tree. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis). Vendor attribution marked low confidence due to 'Unknown Vendor' classification in source data, though kernel.org references confirm Linux kernel as affected product.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46125 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46125

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46125 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46125

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1c2b72ea89882aeb948340498391e69c58d466f1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/283fc9e44ff5b5ac967439b4951b80bd4299f4e4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9e28654f79f443bca9b29ff3ae7cf18abfba58a0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/afcbaed89cdc1a001b43270cbf5394bb4804270a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fe75fa1ac9a92990f7fc3d34b17808fd933071b2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.