CVE-2026-46166
Linux · Kernel
A slab-use-after-free vulnerability exists in the Linux kernel's mac80211 subsystem during radar detection work.
Executive summary
A high-severity use-after-free flaw in the Linux kernel's mac80211 radar detection logic can lead to system crashes or arbitrary code execution.
Vulnerability
The ieee80211_dfs_cac_cancel function can free a channel context while it is still being iterated during radar detection, leading to a use-after-free condition.
Business impact
Exploitation of this vulnerability could lead to system instability, crashes, or potential code execution. The CVSS score of 8.8 highlights the severity of this memory management flaw in the wireless subsystem.
Remediation
Immediate Action: Apply the kernel patch available via the GitHub advisory (GHSA-pqxf-3wq6-69f8) to ensure safe list iteration.
Proactive Monitoring: Monitor system logs for kernel oops related to the mac80211 subsystem.
Compensating Controls: Disable wireless radar detection features if not required, or restrict the affected system's environment to minimize exposure to DFS-related triggers.
Exploitation status
Public Exploit Available: false
Analyst recommendation
Wireless infrastructure administrators must prioritize applying the provided kernel patch to fix this use-after-free vulnerability. Failure to address this could lead to significant system instability and potential security compromises.