CVE-2026-97595 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel-based systems should assess exposure to this vulnerability and apply patches or updates as needed.

Why it matters

A use-after-free vulnerability exists in the Linux kernel's mac802154 subsystem, which could allow an attacker to potentially execute arbitrary code or cause a denial of service.

• Verify Linux kernel versions in use are patched or updated
• Assess exposure of Linux kernel-based systems to this vulnerability
• Monitor for potential exploitation attempts
• Apply patches or updates provided by the Linux kernel maintainers

Technical summary

The RX softirq producer ieee802154_subif_frame() queues received beacon and MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and schedules a process-context worker. However, the lists have no lock, and the workers dereference the interface after it may have been freed, resulting in a use-after-free vulnerability. This issue can allow an attacker to potentially execute arbitrary code or cause a denial of service. Affected Linux kernel maintainers and users should assess exposure and apply patches or updates as needed. The vulnerability was resolved by adding a lock around every list access, pinning the interface for the lifetime of a queued frame, and dequeuing under the lock at the head and loop-

Defensive priority

High

Recommended defensive actions

• Assess exposure of Linux kernel-based systems to this vulnerability
• Verify if Linux kernel versions in use are affected
• Apply patches or updates provided by the Linux kernel maintainers
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was resolved in the Linux kernel by adding a lock around every list access, pinning the interface for the lifetime of a queued frame, and dequeuing under the lock at the head and loop-draining the whole list in the workers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.