CVE-2026-98340
Received
Received - Intake
WiFi: cfg80211 Hidden BSS Grouping Issue
Vulnerability report for CVE-2026-98340, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-06
Last updated on: 2026-10-06
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: only group hidden BSSes with beacon entries
When a probe response for an unknown BSS comes in, __cfg80211_bss_update()
looks for an existing entry with the same BSSID and a hidden (zero-length
or NUL-filled) SSID, and if it finds one it groups them, using the beacon
IEs from the existing entry.
But that could find another entry without a beacon, if it was also from a
probe response (with SSID), so there's a group without beacon elements.
If a beacon with a hidden SSID for that BSSID arrives later,
cfg80211_combine_bsses() goes looking for the probe response entries that
belong to it - i.e. entries with the same BSSID and channel that have no
beacon IEs - and finds those two. They are already grouped with each
other, so it hits its
WARN_ON_ONCE(bss->pub.hidden_beacon_bss)
WARN_ON_ONCE(!list_empty(&bss->hidden_list))
which are there because an entry without beacon elements is not supposed
to be part of a group yet.
Only combine entries when a beacon was already received, ones that are
kept separate will be combined when a beacon arrives.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
| Linux | Linux | 3.9 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
