CVE-2026-64574: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64574 is a use-after-free vulnerability in the Linux kernel's wifi: mac80211 subsystem, specifically in the virtual interface (vif) link update error handling path. When ieee80211_vif_update_links() adds new links and the subsequent drv_change_vif_links() call fails, the error path frees newly allocated link containers without removing their debugfs entries, leaving file->private_data pointers dangling into freed memory. A later open()+read() on these stale debugfs files (e.g., link-1/txpower) triggers a use-after-free in ieee80211_if_read_link(). The vulnerability affects Linux kernel versions from 6.4 up to (but not including) the patched releases: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2. It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-825 (Expired Pointer Dereference). When ieee80211_vif_update_links() allocates new link containers and calls ieee80211_link_init(), per-link debugfs files are registered with file->private_data pointing into those containers. If drv_change_vif_links() subsequently fails — which can occur on MLO (Multi-Link Operation) drivers due to internal allocation, queue, or firmware command failures — the error path restores old pointers and jumps to free, deallocating the containers without invoking ieee80211_tear_down_links() to clean up debugfs entries and stop the links. The existing removal path (for new_links == 0) was hardened by commit be1ba9ed221f, but the newly-added links' teardown on the add-path error branch was left unaddressed. An attacker with local access can then read the dangling debugfs file to trigger a KASAN-detected slab-use-after-free at net/mac80211/debugfs_netdev.c:127, resulting in a kernel panic (Github Advisory, Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to crash the kernel by triggering a use-after-free dereference via stale debugfs file reads, resulting in a kernel panic and complete denial of service. The CVSS scoring also reflects high confidentiality and integrity impact, suggesting potential for memory disclosure or corruption beyond a simple crash in certain exploitation scenarios. The vulnerability is scoped to the local system and does not directly enable remote code execution or lateral movement, but a kernel crash can disrupt all services on the affected host (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability requires local access with low privileges and is only triggerable on systems using MLO-capable Wi-Fi drivers where drv_change_vif_links() can fail at runtime. The EPSS score is approximately 0.116% (2nd percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain local access: Obtain a low-privilege local account on a Linux system running kernel version 6.4 or later with an MLO-capable Wi-Fi driver and debugfs mounted (typically at /sys/kernel/debug).
2. Trigger vif link update failure: Use wireless configuration tools (e.g., iw or a custom program) to initiate a Multi-Link Operation (MLO) virtual interface link addition that causes drv_change_vif_links() to fail internally — for example, by exhausting driver resources or inducing a firmware command failure.
3. Identify dangling debugfs entries: After the failed link update, check for residual debugfs entries under /sys/kernel/debug/ieee80211/<phy>/netdev:<iface>/links/link-<N>/ (e.g., link-1/txpower) that were not cleaned up.
4. Trigger use-after-free: Open and read one of the stale debugfs files (e.g., cat /sys/kernel/debug/ieee80211/<phy>/netdev:<iface>/links/link-1/txpower), causing ieee80211_if_read_link() to dereference the freed container memory.
5. Achieve denial of service: The kernel panics with a KASAN slab-use-after-free report at net/mac80211/debugfs_netdev.c:127, crashing the system (Github Advisory, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing BUG: KASAN: slab-use-after-free in ieee80211_if_read_link; entries referencing net/mac80211/debugfs_netdev.c:127; Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a; Kernel panic - not syncing: Fatal exception.
• Process: Unusual process (e.g., named exploit) performing read() syscalls on debugfs paths under /sys/kernel/debug/ieee80211/; processes accessing link-<N>/txpower or similar per-link debugfs files after a failed MLO link update.
• File System: Presence of stale debugfs entries under /sys/kernel/debug/ieee80211/<phy>/netdev:<iface>/links/ that persist after a failed drv_change_vif_links() operation.
• Network: Repeated or anomalous MLO link add/remove operations on Wi-Fi interfaces observable via iw event or netlink monitoring (Github Advisory, Red Hat Bugzilla).

Apply the upstream kernel patches that properly tear down new links on the vif update error path by removing debugfs entries and stopping links before freeing their containers. Fixed versions are: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2 (and later). Patch commits are available in the stable kernel tree (e.g., 329589417214, c57d97f38130, 0f7eaeb950ad, 901a73523e09, 952c02b33f56). As a workaround where patching is not immediately possible, restricting access to debugfs (e.g., mounting with debugfs inaccessible to unprivileged users, or using kernel lockdown mode) can reduce exposure (Github Advisory, Red Hat Bugzilla).

Red Hat has tracked this issue via Bugzilla (Bug 2511407) with medium priority and severity, and the upstream kernel CVE announcement was posted to the linux-cve-announce mailing list. Microsoft has acknowledged the vulnerability in the context of their Azure Linux 3 kernel package (azl3_kernel_6.6.145.2-1). No significant public researcher commentary or social media discussion has been identified beyond standard CVE aggregator coverage.