PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46166 Linux CVE debrief

A slab-use-after-free vulnerability in the Linux kernel's mac80211 wireless subsystem has been resolved. The issue occurred in the radar detection work handler where unsafe list iteration could lead to accessing freed memory when `ieee80211_dfs_cac_cancel` is called. The fix implements safe list iteration to prevent the use-after-free condition when channel contexts are freed and removed from the list during iteration.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-15
Advisory published
2026-05-28
Advisory updated
2026-07-15

Who should care

Organizations running Linux systems with wireless interfaces utilizing DFS radar detection, particularly in enterprise Wi-Fi deployments, regulatory domains requiring DFS, and embedded/IoT devices with mac80211-based wireless stacks.

Technical summary

The vulnerability exists in the mac80211 subsystem's radar detection work handler. During list iteration over channel contexts, the call to `ieee80211_dfs_cac_cancel` can free and remove the currently iterated channel context from the list. Without safe iteration primitives, this results in a slab-use-after-free when the iterator proceeds to the next element. The resolution implements safe list iteration to handle concurrent modification during traversal.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor vendor security advisories for kernel package updates
  • If running custom kernel builds, cherry-pick the referenced stable commits
  • Review systems utilizing DFS (Dynamic Frequency Selection) radar detection functionality for priority patching

Evidence notes

The vulnerability description indicates a classic use-after-free pattern in kernel list traversal. The fix involves converting to safe list iteration primitives (likely `list_for_each_entry_safe` or equivalent) in the radar detection work function. Multiple stable kernel branches received backports of this fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46166 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46166

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46166 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46166

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.