CVE-2026-64570

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix fils_discovery double free on alloc failure

ieee80211setfilsdiscovery() calls kfreercu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while link->u.ap.filsdiscovery still points at the object already queued for freeing. A later update or AP teardown (ieee80211stopap()) re-queues that same rcuhead; the second free is caught by KASAN when the RCU sheaf is processed in softirq:

BUG: KASAN: double-free in rcufreesheaf (mm/slub.c:5850) Free of addr ffff88800c065280 by task swapper/0/0 ... _rcufreesheafprepare (mm/slub.c:2634 mm/slub.c:2940) rcufreesheaf (mm/slub.c:5850) rcucore (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handlesoftirqs (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-96 of size 96

Queue the old object for kfreercu() only after the new one is published, matching ieee80211setproberesp() and ieee80211sets1gshortbeacon().