{"id":"CVE-2026-98195","revision":"a67a7d9fa97f41c0b6a1360f56e8f98f","records":[{"revision":"a67a7d9fa97f41c0b6a1360f56e8f98f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98195","aliases":[],"title":"wifi: iwlegacy: fix broadcast stations deallocation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: fix broadcast stations deallocation\n\nOn the error path of __il4965_up(), il_dealloc_bcast_stations() clears\nonly IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the\nsame broadcast stations to be deallocated again by __il4965_down().\n\nThis can occur when RF_KILL is toggled during driver startup.\n\nTo fix clear the entire 'used' field, since we will not do any\nother operations on the station.","state":0,"publishedAt":"2026-10-06T08:44:34.915+00:00","modifiedAt":"2026-10-19T09:15:26.463+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/intel/iwlegacy/common.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"275d474a4b4bd4e73b18b1452f12e78806a8843a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"526fdd45548e22eee50ee1062abd88269d9f32e0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"c9a116d691364cd7f59d8329b395adcaf826d5c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"85d847ff71fe736cbc15ada321256818e630e205\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"1d84c2a3de449aceb94ed79eaefecdf1bedb6468\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"55d34422c0d91436983028fd3c1546a1c2bee55f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"a9176fe666af1730cab92350f9c8cf67ebf14439\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2fd34469d1623111e3c3db65cde533f3bddc26e\",\n                            \"lessThan\": \"b5526b780f8b297a76030410b96ba29153afb98f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/intel/iwlegacy/common.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/275d474a4b4bd4e73b18b1452f12e78806a8843a","https://git.kernel.org/stable/c/526fdd45548e22eee50ee1062abd88269d9f32e0","https://git.kernel.org/stable/c/c9a116d691364cd7f59d8329b395adcaf826d5c6","https://git.kernel.org/stable/c/85d847ff71fe736cbc15ada321256818e630e205","https://git.kernel.org/stable/c/1d84c2a3de449aceb94ed79eaefecdf1bedb6468","https://git.kernel.org/stable/c/55d34422c0d91436983028fd3c1546a1c2bee55f","https://git.kernel.org/stable/c/a9176fe666af1730cab92350f9c8cf67ebf14439","https://git.kernel.org/stable/c/b5526b780f8b297a76030410b96ba29153afb98f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98195","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98195","identifiers":["CVE-2026-98195"]},"retained":false,"historicalAffected":[]}],"coverage":[]}