PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46125 Linux CVE debrief

A use-after-free/double-free vulnerability exists in the Linux kernel's mac80211 Wi-Fi subsystem when Multi-Link Operation (MLO) connection preparation fails. The issue occurs because the interface is reset to non-MLD state without properly removing the associated station, which is tied to the virtual interface link being removed. When debugfs is enabled, this leads to memory corruption as the virtual interface recreates its entire debugfs structure while stale station references persist. The vulnerability is triggered during failed MLO connection setup, where the station cleanup path was incomplete for the error handling case.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

Organizations running Linux systems with Wi-Fi 7 (802.11be) hardware and MLO enabled, particularly those with debugfs enabled in production kernel builds. Cloud providers and edge computing deployments using wireless connectivity should monitor for kernel updates.

Technical summary

The mac80211 subsystem in the Linux kernel fails to properly clean up station state when Multi-Link Operation (MLO) connection preparation fails. During MLO setup failure, the virtual interface is reset from MLD to non-MLD state, but the associated station—linked to the virtual interface's link—is not removed. This leaves a dangling station reference that causes use-after-free or double-free conditions when debugfs recreates its structures. The fix ensures station deletion occurs during the connection preparation failure path, matching the cleanup behavior for successfully created stations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits when available from your Linux distribution
  • Monitor distribution security advisories for backported fixes to supported kernel versions
  • If running custom kernel builds with debugfs enabled, prioritize patching due to elevated corruption risk
  • Review systems using Wi-Fi 7 (802.11be) MLO capabilities as the vulnerable code path is specific to MLO connection handling
  • Consider disabling debugfs in production environments if not required for diagnostics to reduce attack surface

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Fix commits identified in kernel.org stable tree. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis). Vendor attribution marked low confidence due to 'Unknown Vendor' classification in source data, though kernel.org references confirm Linux kernel as affected product.

Official resources

2026-05-28