CVE-2026-23185: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23185 is a use-after-free vulnerability in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver. The flaw arises because mlo_scan_start_wk (the Multi-Link Operation scan start work queue item) is not properly canceled on disconnection or when the virtual interface (vif) is freed, potentially allowing heap memory corruption. Affected kernel versions span 6.17 through 6.18.9 and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 7.8 (High), requiring only local, low-privilege access to exploit (Feedly).

The root cause is classified as CWE-416 (Use After Free). The mlo_scan_start_wk work queue item in the iwlwifi MLD driver is queued during Multi-Link Operation scan initiation but is never explicitly canceled on disconnection events. This creates two distinct race conditions: (1) an init-after-queue issue if drv_change_interface executes while the work is still queued, and (2) a use-after-free condition if the work item executes after the associated virtual interface (vif) has already been freed. An attacker with local user-level access on a system using an affected Intel Wi-Fi adapter could trigger these conditions by manipulating interface state transitions (Feedly).

Successful exploitation can result in heap memory corruption, leading to a system crash (denial of service) or potentially arbitrary code execution with elevated kernel privileges. Because the vulnerability operates at the kernel level within the Wi-Fi driver subsystem, a successful exploit could fully compromise system confidentiality, integrity, and availability. Systems running affected Linux kernel versions (6.17–6.18.9 and 6.19-rc1 through 6.19-rc8) with Intel Wi-Fi hardware using the iwlwifi driver are at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local, low-privilege access, limiting its remote attack surface. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The vulnerability is resolved in Linux kernel version 6.18.10 and later. Stable branch patches are available at the kernel Git repository. Administrators should update to kernel 6.18.10 or the final 6.19 release (or later) as soon as possible. As a temporary workaround where patching is not immediately feasible, restricting Wi-Fi functionality or limiting access to interface configuration commands can reduce exposure (Feedly, Kernel Patch 1, Kernel Patch 2).