CVE-2026-98183

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload. Move the helper call after both size checks, so the bottom fields are only accessed when they are present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98183

EUVD

EUVD-2026-93111

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae
Linux	Linux	8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae
Linux	Linux	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's wifi subsystem, specifically in the mac80211 module. It involves an out-of-bounds read issue where the function ieee80211_mesh_preq_size_ok() accesses memory beyond the declared payload of an empty PREQ element. The problem occurs because the function tries to read the flags byte to check for an optional Address Extension field before verifying if the element has even the fixed header.

Detection Guidance

This vulnerability affects the Linux kernel's wifi subsystem, specifically the mac80211 module handling mesh PREQ elements. Detection requires checking kernel versions and monitoring for crashes or memory corruption during wireless operations. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data from the Linux kernel, potentially leading to information disclosure. It may cause system instability or crashes if exploited. Systems using affected Linux kernel versions with mesh networking enabled could be at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue involving an out-of-bounds read in the Linux wifi subsystem, which could potentially lead to memory corruption or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest Linux kernel updates to patch the vulnerability. If immediate patching is not possible, disable mesh networking features or restrict wireless operations until the update is applied.

Hi! I’m here to help you understand CVE-2026-98183. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70