CVE-2026-97595

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the mac802154 module. The ieee802154 subif frame() function queues received beacon and MAC-command frames onto local->rx beacon list and rx mac cmd list without proper locking or references. This leads to two primary issues: first, the lack of locks allows sibling interfaces on the same phy to corrupt the list; second, workers may dereference the interface after it has been freed. Specifically, mac802154 rx mac cmd worker() accesses mac pkt->sdata directly, and mac802154 rx beacon worker() via mac802154 process beacon() dereferences skb->dev. If an interface is removed, its sdata is freed while queued frames still point to it, resulting in a use-after-free when the worker subsequently runs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.