CVE-2026-98195

Executive Summary

CVE-2026-98195 is a Linux kernel vulnerability in the iwlegacy wireless driver, specifically in the error-handling and teardown logic of __il4965_up() and __il4965_down(). When RF_KILL is toggled during driver startup, a partially initialized station object retains the IL_STA_BCAST flag, causing the same broadcast stations to be deallocated a second time during teardown. The defect is a double-free class issue within the driver's station deallocation routines, affecting systems with Intel wireless hardware driven by iwlegacy.

Technical Analysis

The flaw resides in the interaction between two lifecycle functions in the iwlegacy driver: the bring-up path __il4965_up() and the tear-down path __il4965_down(). During bring-up, the driver allocates broadcast stations and marks them with flags that include IL_STA_UCODE_ACTIVE and IL_STA_BCAST. When an error is encountered on the bring-up path, the error handler calls il_dealloc_bcast_stations(). Per the NVD description, this function clears only the IL_STA_UCODE_ACTIVE flag while leaving IL_STA_BCAST set on the station object. The used field therefore remains non-empty after the first deallocation.

Because the used field is not fully cleared, the station remains eligible for deallocation. A subsequent call to __il4965_down() iterates over stations that appear still in use and invokes il_dealloc_bcast_stations() a second time against the same broadcast stations. This constitutes a double-free: memory associated with the station structures is released twice, and the driver's internal accounting is left inconsistent with the actual allocation state.

The trigger condition is a race between driver initialization and RF kill. When RF_KILL is toggled during startup, the driver aborts the bring-up sequence and transitions to teardown, exercising both the error path in __il4965_up() and the normal teardown path in __il4965_down(). This ordering is precisely what produces the duplicate deallocation.

The fix, as described, is to clear the entire used field rather than only the IL_STA_UCODE_ACTIVE bit, since no further operations are performed on the station after the error-path deallocation. This ensures the station is fully removed from the driver's tracking and cannot be deallocated again.

It is important to be precise about what the supplied data does and does not establish. The description identifies the affected functions (__il4965_up(), il_dealloc_bcast_stations(), __il4965_down()), the relevant flags (IL_STA_UCODE_ACTIVE, IL_STA_BCAST), the station tracking field (used), and the trigger (RF_KILL toggled during startup). The description does not specify concrete memory addresses, allocation primitives, lock states, or the exact object size of the affected station structure. Those implementation details are not available and are not asserted here.

The vulnerability class is a double-free / incomplete state cleanup. In kernel context, double-free conditions are serious because they corrupt the allocator's bookkeeping. Depending on allocator behavior, SLUB hardening, and timing, a double-free can lead to memory corruption, kernel panic, or — under favorable conditions for an attacker with a trigger primitive — reuse of a freed object by an attacker-controlled allocation. The supplied description does not state that privilege escalation is achievable, and no PoC or exploit code exists in the data provided.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred from the vulnerability class and the described code paths only. It does not assert specific function names, addresses, or primitives beyond those present in the NVD description.

1) Reconnaissance / target identification. An attacker must already have some form of local access or influence over a system using an Intel wireless device bound to the iwlegacy driver. This is not a network-reachable flaw. Target identification therefore involves determining (a) that the device uses iwlegacy, and (b) that the attacker can influence RF kill state or driver load/unload timing. In many real-world scenarios, "RF_KILL toggled during driver startup" corresponds to a physical or administrative action (rfkill switch, module reload) rather than a remote event.

2) Triggering the specific flaw class. The bug is exercised when driver bring-up (__il4965_up()) takes an error path while a subsequent teardown (__il4965_down()) runs. The described trigger is toggling RF_KILL during driver startup. An attacker or operator able to cause this race — for example by repeatedly loading the module and toggling RF kill, or by inducing initialization failure via hotplug/unplug of the wireless device — can drive the driver into the error path followed by teardown, producing the double-free of broadcast stations.

3) Execution method at the vulnerability-class level. For a double-free, exploitation generally proceeds by arranging for the freed object to be reallocated by a second allocation under the attacker's control, and then using the resulting aliasing (two references to the same memory) to corrupt data. However, the supplied data provides no details about the station object's size, its allocator, or whether any message-passing or user-controlled buffer reuses the same slab. As a result, no concrete payload or execution technique is described here. The honest characterization is: the flaw is a memory-safety condition triggered by a startup/teardown race, but the supplied advisory does not document an exploitation primitive.

4) Post-exploitation impact. The most directly supportable impact is denial of service: a double-free on a kernel object can cause allocator corruption or a kernel panic, taking the affected system down. Any escalation beyond DoS would require the double-free to be reliably usable for object aliasing, which is not established by the available data.

Impact Assessment

The vulnerability affects systems whose Intel wireless hardware is handled by the iwlegacy driver, including the il4965 device family. Because iwlegacy is a legacy driver supporting older Intel wireless chipsets, the affected population skews toward older hardware still in service, including embedded, industrial, and long-lifecycle endpoints where device replacement is slow.

No CVSS score or vector was assigned by NVD (Score: N/A, Vector: N/A), so this report does not assign subscore values. By vulnerability class, the availability impact is the most credible (kernel panic or crash from a double-free), while confidentiality and integrity impact depend on whether object aliasing is achievable — a factor not established by the supplied description. No EPSS score has been published by FIRST.org at the time of writing, and CISA KEV status is negative; there is no evidence of exploitation in the wild.

Blast radius is limited by the local, hardware-dependent trigger: the attacker must be able to influence driver startup/shutdown and RF kill state. This constrains mass exploitation but does not eliminate risk in environments where an unprivileged local actor can reload modules or toggle rfkill, or where hardware faults can repeatedly induce the race.

Detection Guidance

Sigma Rule

title: Linux Kernel iwlegacy Broadcast Station Double-Free Indicator
id: 8f3c1a72-9d4e-4b8a-b0c1-6e2f7a5d9c34
status: experimental
description: Detects repeated iwlegacy driver load/unload or RF-kill toggling consistent with triggering the __il4965_up error-path double-free in CVE-2026-98195.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98195
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_module:
    - 'iwlegacy'
    - 'iwl4965'
  selection_fault:
    - 'il4965'
    - 'dealloc_bcast'
    - 'double free'
    - 'BUG: unable to handle kernel'
  condition: selection_module and selection_fault
falsepositives:
  - Legitimate driver reload during kernel module testing
  - Hardware fault recovery events
level: medium
tags:
  - attack.t1499
  - cve.2026.98195

YARA Rule

rule CVE_2026_98195_iwlegacy_bcast_doublefree
{
    meta:
        description = "Detects iwlegacy kernel module strings associated with the CVE-2026-98195 broadcast station deallocation defect"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98195"
        date = "2026-01-01"

    strings:
        $a = "il_dealloc_bcast_stations"
        $b = "IL_STA_BCAST"
        $c = "IL_STA_UCODE_ACTIVE"
        $d = "__il4965_up"
        $e = "__il4965_down"
        $f = "iwlegacy"

    condition:
        (uint32(0) == 0x7f454c46 or uint32(0) == 0x464c457f) and
        (
            (any of ($a, $d, $e) and any of ($b, $c)) or
            ($f and 2 of ($a, $b, $c, $d, $e))
        )
}

Suricata IDS Rule

alert icmp any any -> any any (msg:"CVE-2026-98195 iwlegacy driver local race - not network observable"; sid:202698195; rev:1; classtype:misc-activity; metadata:cve CVE-2026-98195;)

Note: CVE-2026-98195 is a local kernel driver race condition with no network-exposed protocol or endpoint described in the advisory. Suricata is a network IDS and cannot directly observe the in-kernel double-free. The rule above is a placeholder that will not fire on this vulnerability; network-based detection is not applicable, and this is stated explicitly rather than fabricating a synthetic packet signature.

Elastic Detection

process where event.type == "start" and
  process.name == "modprobe" and
  process.args like~ "*iwlegacy*"

This EQL rule identifies repeated module load events for iwlegacy, which — when correlated with high-frequency reloads or RF-kill toggling — may indicate attempts to trigger the initialization/teardown race described in CVE-2026-98195. Correlate with kernel log entries referencing il4965 deallocation faults.

Splunk SPL Query

index=linux_logs (sourcetype=syslog OR sourcetype=kernel)
("iwlegacy" OR "il4965" OR "il_dealloc_bcast_stations")
| eval severity=case(
    match(_raw, "double free|dealloc_bcast|BUG: unable to handle kernel"), "HIGH",
    match(_raw, "iwlegacy|il4965"), "MEDIUM",
    true(), "LOW")
| stats count values(severity) as sev by host
| where count > 3
| sort - count

This query surfaces hosts emitting repeated iwlegacy/il4965 kernel messages, with higher severity when double-free or kernel-fault indicators appear in the same stream.

Wazuh OSSEC Rule

<group name="linux,kernel,cve-2026-98195,">
  <rule id="100195" level="10">
    <decoded_as>kernel</decoded_as>
    <match>il_dealloc_bcast_stations|double free|il4965</match>
    <description>CVE-2026-98195: Possible iwlegacy broadcast station double-free / kernel fault</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_98195,kernel_fault,</group>
  </rule>

  <rule id="100196" level="6">
    <decoded_as>kernel</decoded_as>
    <match>iwlegacy|il4965</match>
    <description>CVE-2026-98195: iwlegacy driver activity observed</description>
    <group>cve_2026_98195,driver_activity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version list was supplied.

1) Immediate mitigations. Because the trigger is a race between driver startup and RF kill state, reduce the opportunity to induce it: avoid toggling RF kill (physical switch or rfkill command) while iwlegacy is initializing; avoid rapid module reload cycles. Where the wireless hardware is not required, blacklist or unload the iwlegacy driver to remove the attack surface entirely. Restrict local users' ability to load/unload kernel modules and to manipulate rfkill state (privilege separation on module loading, disabling unprivileged module operations).

2) Patch/upgrade steps. No patch reference, upstream commit, or stable backport is available in the supplied data, so no specific upgrade target can be named. The described fix clears the entire used field in the error path instead of only IL_STA_UCODE_ACTIVE. Track upstream Linux kernel iwlegacy changes and stable/longterm trees, and apply the official fix once an advisory or commit identifier is published. Do not treat any locally reconstructed edit as a validated patch.

3) Long-term hardening. Enable kernel memory-safety hardening such as SLUB debugging (slub_debug) and KASAN in test/staging systems to surface double-free and use-after-free conditions early. Deploy kernel live-patching capability to keep the driver current without extending downtime. Because this is a legacy driver, plan hardware roadmaps toward supported wireless devices to reduce dependence on iwlegacy. Maintain kernel log monitoring for the detection rules above, and incorporate new vendor advisories for this CVE as they materialize.

References

• NVD — CVE-2026-98195: https://nvd.nist.gov/vuln/detail/CVE-2026-98195
• CWE-459 — Incomplete Cleanup: https://cwe.mitre.org/data/definitions/459.html
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST.org EPSS — no score published for CVE-2026-98195 at time of writing: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-98195 not listed (no exploit-in-the-wild evidence): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploitation in the wild, or public PoC have been identified for CVE-2026-98195 in the supplied data.