{"id":4648,"date":"2026-09-04T18:46:40","date_gmt":"2026-09-04T10:46:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64568"},"modified":"2026-09-04T18:46:40","modified_gmt":"2026-09-04T10:46:40","slug":"cve-2026-64568","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64568","title":{"rendered":"CVE-2026-64568 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix u"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure<\/p>\n<p>ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() on the old<br \/>\ntemplate before allocating the replacement. If the kzalloc() then fails,<br \/>\nit returns -ENOMEM while link-&gt;u.ap.unsol_bcast_probe_resp still points<br \/>\nat the object already queued for freeing. A later update or AP teardown<br \/>\nre-queues that same rcu_head; the second free is caught by KASAN when the<br \/>\nRCU sheaf is processed in softirq:<\/p>\n<p>  BUG: KASAN: double-free in rcu_free_sheaf (mm\/slub.c:5850)<br \/>\n  Free of addr ffff88800d06f300 by task exploit\/145<br \/>\n   &#8230;<br \/>\n   __rcu_free_sheaf_prepare (mm\/slub.c:2634 mm\/slub.c:2940)<br \/>\n   rcu_free_sheaf (mm\/slub.c:5850)<br \/>\n   rcu_core (kernel\/rcu\/tree.c:2617 kernel\/rcu\/tree.c:2869)<br \/>\n   handle_softirqs (kernel\/softirq.c:622)<br \/>\n  The buggy address belongs to the cache kmalloc-128 of size 128<\/p>\n<p>Queue the old object for kfree_rcu() only after the new one is published,<br \/>\nmatching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure<\/p>\n<p>ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() o<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4648","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}