CVE-2026-98329
Received Received - Intake

Wi-Fi Frame Injection in Linux Kernel

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98329
EUVD
EUVD-2026-93314

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 646e76bb5daf4ca38438c69ffb72cccb605f3466
Linux Linux 646e76bb5daf4ca38438c69ffb72cccb605f3466
Linux Linux 646e76bb5daf4ca38438c69ffb72cccb605f3466
Linux Linux 646e76bb5daf4ca38438c69ffb72cccb605f3466
Linux Linux 4.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the mac80211 subsystem that handles Wi-Fi frame injection. Attackers can send specially crafted Wi-Fi frames with a radiotap header requesting an excessive bandwidth that exceeds the actual operational bandwidth of the channel. The system fails to validate this request properly, leading to a warning in the hwsim module.

Detection Guidance

This vulnerability involves mac80211 allowing injection of frames wider than the channel bandwidth, which triggers a warning in hwsim. Detection requires monitoring for these warnings or unusual frame injections. Check kernel logs for 'WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw))' messages using 'dmesg | grep hwsim' or 'journalctl -k | grep hwsim'.

Impact Analysis

This vulnerability could allow attackers to disrupt Wi-Fi communications by injecting malformed frames that trigger warnings or errors in the kernel. While it may not directly lead to data breaches, it could cause denial-of-service conditions or instability in Wi-Fi networks using affected Linux kernel versions.

Mitigation Strategies

Apply the latest Linux kernel update to patch this issue. Disable monitor interfaces if not needed. Restrict frame injection capabilities to trusted users. Monitor network traffic for abnormal frame sizes or injection attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98329. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart