CVE-2026-64574

A moderate-impact use-after-free flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When ieee80211_vif_update_links() adds new Wi-Fi links and the subsequent drv_change_vif_links() driver callback fails, which can occur at runtime on multi-link operation (MLO) capable drivers due to internal allocation, queue, or firmware command failures, the error path frees the newly allocated link containers without removing their per-link debugfs entries or stopping the links. The surviving debugfs files keep file->private_data pointing into the freed memory, so a local attacker who can read one of these dangling debugfs entries (for example link-1/txpower) triggers a use-after-free read in ieee80211_if_read_link(), causing a kernel panic and a denial of service.

The affected scope covers the kernel and kernel-rt components of Red Hat Enterprise Linux 8 (8.10 update stream), Red Hat Enterprise Linux 9 (9.4, 9.6, 9.8, and 9.9 streams), Red Hat Enterprise Linux 10 (10.0, 10.2, and 10.3 streams), and Red Hat In-Vehicle OS 2, including its kernel-ivos-qualcomm component; in these streams the fix is currently deferred. Earlier Red Hat Enterprise Linux streams (RHEL 6 ELS, RHEL 7 ELS, and the RHEL 8.4, 8.6, 8.8, and RHEL 9.2 update streams) are not affected because the code that registers the per-link debugfs data this flaw depends on is not present in those versions.

Because the fix is deferred, a residual risk remains: a local user who can access a dangling per-link debugfs entry left behind after a failed Wi-Fi link update on an MLO-capable driver could crash the kernel and cause denial of service. Exploitability is limited, since triggering the flaw requires local access, a runtime driver failure during a link update, and read access to the Wi-Fi debugfs files, which is typically restricted to privileged users, and the demonstrated impact is a system crash rather than loss of confidentiality or integrity.

The upstream CVE record rates this flaw Important (CVSS 3.1 score 7.8), while Red Hat rates it Moderate (CVSS 3.1 score 5.5). Red Hat's lower rating reflects that exploitation requires local access, depends on a rare error path in MLO-capable Wi-Fi drivers, and results in denial of service with no established confidentiality or integrity impact.