CVE-2026-64570

A moderate-impact double-free flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem, in the handling of FILS (Fast Initial Link Setup) Discovery templates on Wi-Fi access points. When a FILS Discovery template is updated, ieee80211_set_fils_discovery() queues the old template for deferred RCU freeing before allocating the replacement; if that allocation fails, the stored pointer still references memory already queued for freeing, and a later template update or AP teardown can queue the same object for freeing a second time. This double free causes memory corruption that is likely to result in a kernel crash and denial of service. Triggering the flaw requires local privileges to reconfigure a Wi-Fi access point operating with FILS Discovery (for example CAP_NET_ADMIN), and it additionally depends on a memory allocation failure occurring during a template update, so the practical impact is a local denial of service. The kernel packages in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 are affected; Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and the earlier RHEL 9.2 update stream are not affected because the vulnerable code is not present in those kernels. The fix for the affected products has been deferred because the flaw is a moderate-severity local denial of service that requires privileged local access and an unlikely allocation failure to trigger; the residual risk of deferring the fix is limited to a local kernel crash. Red Hat rates this flaw Moderate with a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), whereas the upstream CVE record assigns 7.8 by assuming high confidentiality and integrity impact from the double-free memory corruption; Red Hat's assessment is that the realistic impact of this flaw is denial of service.