CVE-2026-64568

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix unsolbcastprobe_resp double free on alloc failure

ieee80211setunsolbcastproberesp() calls kfreercu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.unsolbcastproberesp still points at the object already queued for freeing. A later update or AP teardown re-queues that same rcuhead; the second free is caught by KASAN when the RCU sheaf is processed in softirq:

BUG: KASAN: double-free in rcufreesheaf (mm/slub.c:5850) Free of addr ffff88800d06f300 by task exploit/145 ... _rcufreesheafprepare (mm/slub.c:2634 mm/slub.c:2940) rcufreesheaf (mm/slub.c:5850) rcucore (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handlesoftirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-128 of size 128

Queue the old object for kfreercu() only after the new one is published, matching ieee80211setproberesp() and ieee80211sets1gshortbeacon().