{"id":4649,"date":"2026-09-04T18:46:40","date_gmt":"2026-09-04T10:46:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64570"},"modified":"2026-09-04T18:46:40","modified_gmt":"2026-09-04T10:46:40","slug":"cve-2026-64570","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64570","title":{"rendered":"CVE-2026-64570 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix f"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: mac80211: fix fils_discovery double free on alloc failure<\/p>\n<p>ieee80211_set_fils_discovery() calls kfree_rcu() on the old template<br \/>\nbefore allocating the replacement. If the kzalloc() then fails, it<br \/>\nreturns -ENOMEM while link-&gt;u.ap.fils_discovery still points at the<br \/>\nobject already queued for freeing. A later update or AP teardown<br \/>\n(ieee80211_stop_ap()) re-queues that same rcu_head; the second free is<br \/>\ncaught by KASAN when the RCU sheaf is processed in softirq:<\/p>\n<p>  BUG: KASAN: double-free in rcu_free_sheaf (mm\/slub.c:5850)<br \/>\n  Free of addr ffff88800c065280 by task swapper\/0\/0<br \/>\n   &#8230;<br \/>\n   __rcu_free_sheaf_prepare (mm\/slub.c:2634 mm\/slub.c:2940)<br \/>\n   rcu_free_sheaf (mm\/slub.c:5850)<br \/>\n   rcu_core (kernel\/rcu\/tree.c:2617 kernel\/rcu\/tree.c:2869)<br \/>\n   handle_softirqs (kernel\/softirq.c:622)<br \/>\n  The buggy address belongs to the cache kmalloc-96 of size 96<\/p>\n<p>Queue the old object for kfree_rcu() only after the new one is published,<br \/>\nmatching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: mac80211: fix fils_discovery double free on alloc failure<\/p>\n<p>ieee80211_set_fils_discovery() calls kfree_rcu() on the old templa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4649","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}