CVE-2026-46166: linux Use After Free
CVSS: 8.8v3.1HighModified
AliasesUBUNTU-CVE-2026-46166DEBIAN-CVE-2026-46166
Published 28-05-2026Last modified 19-10-2026
Vulnerability summary
CVE-2026-46166 is a high (CVSS 8.8) Use After Free vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.9% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
0.29%
0%100%
Low · +0.08 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 24 · Related 20OPENSUSE-SU-2026:10954-1OPENSUSE-SU-2026:21555-1RHSA-2026:27288RHSA-2026:27708RHSA-2026:27789RHSA-2026:33215SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23221-1SUSE-SU-2026:23231-1SUSE-SU-2026:23237-1SUSE-SU-2026:3130-1SUSE-SU-2026:3166-1USN-8566-1USN-8568-1USN-8569-1USN-8593-1USN-8603-1USN-8618-1USN-8663-1USN-8664-1USN-8728-1USN-8728-2USN-8728-3
Timeline
- 28-05-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-after-free error.
CVSS metrics
4 scores · 4 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources4 sources · 7.0–8.8
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
+0.08 pp
From 0.20% on 19-09-2026
19-09-202619-10-2026
EPSS score0.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- CWE-825Expired Pointer DereferenceThe product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
Affected systems
Ubuntu118 products
- linuxAll versions (No fix recorded) | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ bca8bc0399ac2efd56e6adbed0307e10125a556c, < 887ece6c23b49d02a6678e7a8d5ad213d75883ce | ≥ bca8bc0399ac2efd56e6adbed0307e10125a556c, < 7577a4b8a10fab45a6ee2045ea038a5adadbb585 | ≥ bca8bc0399ac2efd56e6adbed0307e10125a556c, < 120149fb3ebcf674832ca3cafd32bedcdb686dde | ≥ bca8bc0399ac2efd56e6adbed0307e10125a556c, < ac8eb3e18f41e2cc8492cc1d358bcb786c850270 | 6.12
- linux_kernel≥ 6.12, < 6.12.88 | ≥ 6.13, < 6.18.30 | ≥ 6.19, < 7.0.7 | 7.1:rc1 | 7.1:rc2
Debian1 product
- linux< 6.12.88-1 | < 7.0.7-1
3 vendors · 121 products
