CVE-2026-97599 - Vulnerability Details

- ieee802154: hwsim: serialize pib updates to fix double-free

Description

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: hwsim: serialize pib updates to fix double-free

hwsim_update_pib() does an unserialized read-swap-free of phy->pib:

pib_old = rtnl_dereference(phy->pib);
...
rcu_assign_pointer(phy->pib, pib);
kfree_rcu(pib_old, rcu);

It assumes the RTNL is held, but ->set_channel is not always called
under it: the mac802154 scan worker changes channels via
drv_set_channel() without the RTNL. Such an update can race an
RTNL-held one on the same phy; both read the same pib_old and both
kfree_rcu() it, double-freeing the object. With SLUB percpu sheaves
batching kfree_rcu(), this surfaces as a KASAN invalid-free in
rcu_free_sheaf().

struct hwsim_phy has no lock for pib. Add one and make the swap atomic
with rcu_replace_pointer() under it, dropping the misleading
rtnl_dereference().

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a double-free bug in the IEEE 802.15.4 hwsim driver. When a Physical Information Base (PIB) is updated without serialization, two concurrent operations can free the same memory region. This leads to kernel memory corruption and potential system instability or denial of service.

Affected Systems

All Linux kernel releases that contain the unpatched hwsim driver source are affected. No specific kernel version range is provided in the CVE data, so any kernel that includes the vulnerable code could be impacted.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, implying a low likelihood of exploitation. The attack scenario described requires a race condition between a RTNL‑held PIB update and a driver channel change performed without RTNL protection; based on this description it is inferred that the required conditions are typically local or involve privileged operations, but the CVE data does not explicitly state the attack vector or privilege level.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f25da51fdc381ca2863248c7060b3662632f0872`	affected	< e3b4681197aa026bd2d79358de5a3d62b76b04b9
`f25da51fdc381ca2863248c7060b3662632f0872`	affected	< 9973b3a67a7592a780ea12b08334539a900deec1
`f25da51fdc381ca2863248c7060b3662632f0872`	affected	< d3b8f264ce09573aededd0a97dc41c8147797d8f
`f25da51fdc381ca2863248c7060b3662632f0872`	affected	< db6442deecb1f13aeaf4f9d77746ea7555630fb3
`f25da51fdc381ca2863248c7060b3662632f0872`	affected	< 979d5b8de8ed4e1f997aef12da5694b99be7b871

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f25da51fdc381ca2863248c7060b3662632f0872,9973b3a67a7592a780ea12b08334539a900deec1)`	affected	code_commit	—
`[f25da51fdc381ca2863248c7060b3662632f0872,d3b8f264ce09573aededd0a97dc41c8147797d8f)`	affected	code_commit	—
`[f25da51fdc381ca2863248c7060b3662632f0872,db6442deecb1f13aeaf4f9d77746ea7555630fb3)`	affected	code_commit	—
`[f25da51fdc381ca2863248c7060b3662632f0872,979d5b8de8ed4e1f997aef12da5694b99be7b871)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.19`	affected	semver	—
`[0,4.19)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that serializes PIB updates, such as the commit referenced in the advisories.
If updating the kernel is not possible, disable the ieee802154 hwsim module or prevent it from loading in your environment.
As a temporary measure, avoid performing operations that trigger mac802154 scans or channel changes without holding the RTNL lock, or ensure that channel changes are protected by the serialization lock introduced by the patch.

Generated by OpenCVE AI on October 1, 2026 at 12:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97599.mbox
https://git.kernel.org/stable/c/979d5b8de8ed4e1f997aef12da5694b99be7b871
https://git.kernel.org/stable/c/9973b3a67a7592a780ea12b08334539a900deec1
https://git.kernel.org/stable/c/d3b8f264ce09573aededd0a97dc41c8147797d8f
https://git.kernel.org/stable/c/db6442deecb1f13aeaf4f9d77746ea7555630fb3
https://git.kernel.org/stable/c/e3b4681197aa026bd2d79358de5a3d62b76b04b9
https://nvd.nist.gov/vuln/detail/CVE-2026-97599
https://www.cve.org/CVERecord?id=CVE-2026-97599

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/e3b4681197aa026bd2d79358de5a3d62b76b04b9

Thu, 01 Oct 2026 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-415

Wed, 30 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97599.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97599 https://www.cve.org/CVERecord?id=CVE-2026-97599
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 14:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-415

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ieee802154: hwsim: serialize pib updates to fix double-free hwsim_update_pib() does an unserialized read-swap-free of phy->pib: pib_old = rtnl_dereference(phy->pib); ... rcu_assign_pointer(phy->pib, pib); kfree_rcu(pib_old, rcu); It assumes the RTNL is held, but ->set_channel is not always called under it: the mac802154 scan worker changes channels via drv_set_channel() without the RTNL. Such an update can race an RTNL-held one on the same phy; both read the same pib_old and both kfree_rcu() it, double-freeing the object. With SLUB percpu sheaves batching kfree_rcu(), this surfaces as a KASAN invalid-free in rcu_free_sheaf(). struct hwsim_phy has no lock for pib. Add one and make the swap atomic with rcu_replace_pointer() under it, dropping the misleading rtnl_dereference().
Title		ieee802154: hwsim: serialize pib updates to fix double-free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/979d5b8de8ed4e1f997aef12da5694b99be7b871 https://git.kernel.org/stable/c/9973b3a67a7592a780ea12b08334539a900deec1 https://git.kernel.org/stable/c/d3b8f264ce09573aededd0a97dc41c8147797d8f https://git.kernel.org/stable/c/db6442deecb1f13aeaf4f9d77746ea7555630fb3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:22:13.606Z

Updated: 2026-10-19T09:10:02.984Z

Reserved: 2026-09-24T16:01:01.157Z

Link: CVE-2026-97599

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:11.243

Modified: 2026-10-19T10:17:29.587

Link: CVE-2026-97599

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-97599 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T12:15:05Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object