{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "f25da51fdc381ca2863248c7060b3662632f0872"
            },
            {
              "fixed": "9973b3a67a7592a780ea12b08334539a900deec1"
            },
            {
              "fixed": "d3b8f264ce09573aededd0a97dc41c8147797d8f"
            },
            {
              "fixed": "db6442deecb1f13aeaf4f9d77746ea7555630fb3"
            },
            {
              "fixed": "979d5b8de8ed4e1f997aef12da5694b99be7b871"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.19.0"
            },
            {
              "fixed": "6.12.111"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97599.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: hwsim: serialize pib updates to fix double-free\n\nhwsim_update_pib() does an unserialized read-swap-free of phy-\u003epib:\n\n\tpib_old = rtnl_dereference(phy-\u003epib);\n\t...\n\trcu_assign_pointer(phy-\u003epib, pib);\n\tkfree_rcu(pib_old, rcu);\n\nIt assumes the RTNL is held, but -\u003eset_channel is not always called\nunder it: the mac802154 scan worker changes channels via\ndrv_set_channel() without the RTNL. Such an update can race an\nRTNL-held one on the same phy; both read the same pib_old and both\nkfree_rcu() it, double-freeing the object. With SLUB percpu sheaves\nbatching kfree_rcu(), this surfaces as a KASAN invalid-free in\nrcu_free_sheaf().\n\nstruct hwsim_phy has no lock for pib. Add one and make the swap atomic\nwith rcu_replace_pointer() under it, dropping the misleading\nrtnl_dereference().",
  "id": "CVE-2026-97599",
  "modified": "2026-09-27T03:30:43.444846492Z",
  "published": "2026-09-25T10:22:13.606Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/979d5b8de8ed4e1f997aef12da5694b99be7b871"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9973b3a67a7592a780ea12b08334539a900deec1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3b8f264ce09573aededd0a97dc41c8147797d8f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/db6442deecb1f13aeaf4f9d77746ea7555630fb3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97599.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97599"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "ieee802154: hwsim: serialize pib updates to fix double-free"
}