CVE-2026-23185 wifi: iwlwifi: mld: cancel mlo_scan_start_wk
A use-after-free vulnerability in the Linux kernel's iwlwifi driver allows attackers to cause denial of service or execute arbitrary code via improper work queue cancellation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23185?
CVE-2026-23185 is a high-severity use after free vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: cancel mlo_scan_start_wk
mlo_scan_start_wk is not canceled on disconnection. In fact, it is not canceled anywhere except in the restart cleanup, where we don't really have to.
This can cause an init-after-queue issue: if, for example, the work was queued and then drv_change_interface got executed.
This can also cause use-after-free: if the work is executed after the vif is freed.
Which versions are affected by CVE-2026-23185?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23185?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-23185 being exploited?
There is no known exploitation of CVE-2026-23185 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23185, DEBIAN-CVE-2026-23185, GHSA-3jpp-f2wm-pcvv, UBUNTU-CVE-2026-23185.