CVE-2026-98335
Received Received - Intake

Channel Switch Abort Flaw in Linux Kernel

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211_stop_mesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272 Call Trace: ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093 ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147 ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline] __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline] ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438 Abort the channel switch properly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98335
EUVD
EUVD-2026-93320

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux b8456a14e9d2770846fcf74de18ff95b676149a3
Linux Linux b8456a14e9d2770846fcf74de18ff95b676149a3
Linux Linux b8456a14e9d2770846fcf74de18ff95b676149a3
Linux Linux b8456a14e9d2770846fcf74de18ff95b676149a3
Linux Linux 3.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bug in the mac80211 subsystem related to WiFi mesh networking. When leaving a mesh network, the code fails to properly abort a channel switch announcement (CSA), leaving it active even though the channel context is released. This causes a crash when the system tries to finalize the CSA, leading to a null-pointer dereference and kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and mesh networking. Detection requires checking kernel logs for crashes related to ieee80211_stop_mesh() or channel switch abort failures. Monitor logs for Oops messages or null-ptr-deref errors in mac80211 components.

Impact Analysis

This vulnerability can cause system crashes (kernel panic) when a user leaves a WiFi mesh network, potentially leading to denial of service. It may disrupt wireless network operations and require a system reboot to recover.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. Disable mesh networking if not in use. Monitor kernel logs for crashes and restart affected services if errors occur.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart