{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97595 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97595 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97595 and fix it if it is affected.\n\nWhat it is: CVE-2026-97595 is a high-severity use after free vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97595 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97595/ (Markdown: https://insights.sbomify.com/CVE-2026-97595/index.md)","id":"CVE-2026-97595","markdown":"https://insights.sbomify.com/CVE-2026-97595/index.md","name":"CVE-2026-97595","record":{"aliases":["AZL-104334","BELL-CVE-2026-97595","DEBIAN-CVE-2026-97595","GHSA-jxcw-xwwv-r3hm","UBUNTU-CVE-2026-97595"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A use-after-free vulnerability in the Linux kernel mac802154 subsystem allows attackers to cause denial of service or potentially execute code via crafted MAC command frames.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix use-after-free of sdata via queued RX frames\n\nThe RX softirq producer ieee802154_subif_frame() queues received beacon\nand MAC-command frames onto local-\u003erx_beacon_list / rx_mac_cmd_list and\nschedules a process-context worker, storing a raw mac_pkt-\u003esdata (and\nskb-\u003edev == sdata-\u003edev) with neither a reference nor any locking:\n\n - the lists have no lock: the softirq producer list_add_tail()s while the\n   mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt\n   the list;\n\n - the workers dereference the interface after it may have been freed.\n   mac802154_rx_mac_cmd_worker() touches mac_pkt-\u003esdata directly, and\n   mac802154_rx_beacon_worker() -\u003e mac802154_process_beacon() dereferences\n   skb-\u003edev (== sdata-\u003edev). Removing an interface frees its sdata\n   (netdev_priv) while a queued frame still points at it, so a later worker\n   run is a use-after-free.\n\nReproduced under KASAN by flooding a victim interface with MAC command\nframes and removing it (the beacon path is the same class via skb-\u003edev):\n\n  BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n  Read of size 4 at addr ffff888002f9ea18 by task kworker/u8:1/31\n  Workqueue: phy0-mac-cmds mac802154_rx_mac_cmd_worker [mac802154]\n  Call Trace:\n   mac802154_rx_mac_cmd_worker+0x463/0x630 [mac802154]\n   process_one_work+0x611/0xe80\n   worker_thread+0x52e/0xdc0\n   kthread+0x30c/0x630\n   ret_from_fork+0x2fd/0x3e0\n\nFix both lists together:\n\n - add local-\u003erx_lock and take it around every list access: the softirq\n   producer (plain spin_lock, softirq context) and the workers and flush\n   (spin_lock_bh, process context);\n\n - pin the interface for the lifetime of a queued frame with\n   netdev_hold()/netdev_put(), so the worker can safely dereference sdata /\n   skb-\u003edev even while the interface is being removed;\n\n - dequeue under the lock at the head and loop-drain the whole list in the\n   workers (they previously processed one frame per run and relied on a\n   later enqueue to drain the rest);\n\n - drop not-yet-started frames of an interface before it is unregistered,\n   from ieee802154_if_remove() (after the RCU grace period) and from the\n   ieee802154_remove_interfaces() loop -- the latter is the whole-phy\n   teardown path, which does not go through ieee802154_if_remove().\n\nAn in-flight worker that already dequeued a frame keeps its own netdev\nreference; unregister_netdevice() then waits it out in netdev_run_todo(),\nwhich runs at rtnl_unlock() (rtnl released) and after the interface has\nbeen closed, so it does not pin rtnl. A worker blocked in an association\nTX only delays that one interface's unregister (the usual \"waiting for %s\nto become free\"), it does not hold rtnl. netdev_hold() is used for this\nreason instead of a cancel_work_sync() under rtnl, which would block on\nthe worker's unbounded MLME TX wait via ieee802154_sync_queue().\n\nThe mac-command worker additionally skips processing for a stopped\ninterface (ieee802154_sdata_running()), avoiding a needless association\nresponse during teardown.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mac802154: fix use-after-free of sdata via queued RX frames","id":"CVE-2026-97595","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ipvs: reject invalid states in connection template sync records","id":"CVE-2026-97596"},"packages":[],"prev":{"headline":"landlock: Fix use-after-free of the source's parent directory","id":"CVE-2026-97594"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel mac802154 subsystem allows attackers to cause denial of service or potentially execute code via crafted MAC command frames.","url":"https://insights.sbomify.com/CVE-2026-97595/"}