CVE-2026-97599 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems that utilize the ieee802154 hwsim component, should assess exposure and verify inventory. Additionally, security teams and vulnerability management teams should review the vulnerability and apply the patch or mitigations as necessary.

Why it matters

The Linux kernel's ieee802154 hwsim component has a double-free vulnerability that can cause KASAN invalid-free errors. Linux kernel developers and maintainers should assess exposure and verify inventory.

• Potential denial of service (DoS) due to KASAN invalid-free errors
• Possible elevation of privileges or arbitrary code execution
• Verification of Linux kernel patch application and system logging for KASAN errors

Technical summary

The Linux kernel's ieee802154 hwsim component has a double-free vulnerability. The hwsim_update_pib function does not properly serialize updates to the phy->pib pointer, allowing multiple threads to free the same memory location. This can cause a KASAN invalid-free error when using SLUB percpu sheaves batching kfree_rcu. The vulnerability is caused by a lack of proper synchronization in the hwsim_update_pib function. To fix this vulnerability, a lock has been added to the hwsim_phy struct and rcu_replace_pointer is used to update the phy->pib pointer in a safe manner.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the Linux kernel patch to fix the double-free vulnerability
• Monitor system logs for KASAN invalid-free errors
• Consider implementing additional security controls to prevent exploitation
• Verify Linux kernel patch application and system logging for KASAN errors
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Linux kernel patch notes and Git commit history provide additional context. The vulnerability was introduced in the Linux kernel's ieee802154 hwsim component, which is used to simulate IEEE 802.15.4 radios. The patch provided by the Linux kernel developers fixes the double-free vulnerability by adding a lock to the hwsim_phy struct and using rcu_replace_pointer to update the phy->pib pointer in a safe manner.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.