{"id":"CVE-2026-23185","state":"PUBLISHED","title":"wifi: iwlwifi: mld: cancel mlo_scan_start_wk","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: cancel mlo_scan_start_wk\n\nmlo_scan_start_wk is not canceled on disconnection. In fact, it is not\ncanceled anywhere except in the restart cleanup, where we don't really\nhave to.\n\nThis can cause an init-after-queue issue: if, for example, the work was\nqueued and then drv_change_interface got executed.\n\nThis can also cause use-after-free: if the work is executed after the\nvif is freed.","publishedAt":"2026-02-14T16:27:14.815Z","updatedAt":"2026-10-19T18:25:34.589Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9748ad82a9d92b036ff3115207e36e2b9932e354","status":"affected","lessThan":"9b9f52f052f4953fecd2190ae2dde3aa76d10962","versionType":"git"},{"version":"9748ad82a9d92b036ff3115207e36e2b9932e354","status":"affected","lessThan":"5ff641011ab7fb63ea101251087745d9826e8ef5","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/iface.c","drivers/net/wireless/intel/iwlwifi/mld/mac80211.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.18.10","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/iface.c","drivers/net/wireless/intel/iwlwifi/mld/mac80211.c"]}],"references":["https://git.kernel.org/stable/c/9b9f52f052f4953fecd2190ae2dde3aa76d10962","https://git.kernel.org/stable/c/5ff641011ab7fb63ea101251087745d9826e8ef5","https://access.redhat.com/security/cve/CVE-2026-23185","https://bugzilla.redhat.com/show_bug.cgi?id=2439925","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23185.json"],"weaknesses":["CWE-772","CWE-416"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23185.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23185","state":"PUBLISHED","datePublished":"2026-02-14T16:27:14.815Z","dateUpdated":"2026-10-19T18:25:34.589Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:45.984Z"},"containers":{"cna":{"title":"wifi: iwlwifi: mld: cancel mlo_scan_start_wk","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: cancel mlo_scan_start_wk\n\nmlo_scan_start_wk is not canceled on disconnection. In fact, it is not\ncanceled anywhere except in the restart cleanup, where we don't really\nhave to.\n\nThis can cause an init-after-queue issue: if, for example, the work was\nqueued and then drv_change_interface got executed.\n\nThis can also cause use-after-free: if the work is executed after the\nvif is freed."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9748ad82a9d92b036ff3115207e36e2b9932e354","status":"affected","lessThan":"9b9f52f052f4953fecd2190ae2dde3aa76d10962","versionType":"git"},{"version":"9748ad82a9d92b036ff3115207e36e2b9932e354","status":"affected","lessThan":"5ff641011ab7fb63ea101251087745d9826e8ef5","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/iface.c","drivers/net/wireless/intel/iwlwifi/mld/mac80211.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.18.10","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/iface.c","drivers/net/wireless/intel/iwlwifi/mld/mac80211.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/9b9f52f052f4953fecd2190ae2dde3aa76d10962"},{"url":"https://git.kernel.org/stable/c/5ff641011ab7fb63ea101251087745d9826e8ef5"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability requires local access to manage WiFi interfaces — freeing the vif (via interface removal or drv_change_interface) needs CAP_NET_ADMIN operations that an adjacent WiFi attacker cannot trigger remotely.\nAC:L - A local attacker controls both sides: they can trigger MLO link activation (scheduling the 5-second delayed work) and then immediately change/remove the interface before the work fires. The 5-second window is generous and fully attacker-controlled.\nPR:L - WiFi connection management is available to unprivileged users through NetworkManager, and various automatic interface management paths (driver restart, hardware events) could trigger the vif free without explicit root action.\nUI:N - No user interaction is required — the attacker can trigger the entire sequence (WiFi connection, link activation, disconnection, interface change) programmatically.\nS:U - The vulnerability and its impact are both within the kernel's WiFi driver subsystem — no security boundary is crossed.\nC:H - The use-after-free allows reading freed memory that may be reallocated with sensitive data, providing arbitrary kernel memory read primitives through heap spraying techniques.\nI:H - The use-after-free enables heap spraying to control the freed mld_vif object, providing write primitives and potential control flow hijacking for arbitrary code execution in kernel context.\nA:H - The use-after-free will cause a kernel crash (oops/panic) when the delayed work accesses the freed mld_vif structure through container_of."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:20:32.502Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.19"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"kernel: wifi: iwlwifi: mld: cancel mlo_scan_start_wk","descriptions":[{"lang":"en","value":"A flaw was found in the Linux kernel's iwlwifi driver. This vulnerability occurs because a specific work item, `mlo_scan_start_wk`, is not properly canceled when a network device disconnects. This oversight can lead to a use-after-free condition, where the system attempts to access memory that has already been released. A local attacker with high privileges could potentially exploit this to cause a system crash (denial of service) or execute unauthorized code."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"kernel","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"kernel-rt","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"kernel-rt","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"kernel-rt","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-23185","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439925","name":"RHBZ#2439925","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23185.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-772","description":"Missing Release of Resource after Effective Lifetime","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-14T12:04:29.200Z"},"datePublic":"2026-02-14T00:00:00.000Z","timeline":[{"lang":"en","time":"2026-02-14T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-02-14T00:00:00.000Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"To mitigate this issue, prevent the `iwlwifi` kernel module from loading by creating a modprobe configuration file. This will disable Wi-Fi functionality on the system. \n\nCreate a file named `/etc/modprobe.d/blacklist-iwlwifi.conf` with the following content:\n```\nblacklist iwlwifi\n```\n\nAfter creating the file, a system reboot is required for the changes to take effect."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-23185","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:06:45.500060Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:25:34.589Z"}}]}}}