CVE-2026-98702
Received Received - Intake

Wi-Fi 6E Channel Width Validation Flaw in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but continues with an uninitialized vht_operation.chan_width, which is then read by ieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a received frame panic the kernel. Reject the channel definition before entering the VHT operation conversion. This preserves the existing CSA fallback while avoiding both the warning and the uninitialized read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98702
EUVD
EUVD-2026-103956

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 21c3f8f95554feff9bed15703e89adbe582e0383
Linux Linux 21c3f8f95554feff9bed15703e89adbe582e0383
Linux Linux 21c3f8f95554feff9bed15703e89adbe582e0383
Linux Linux 21c3f8f95554feff9bed15703e89adbe582e0383
Linux Linux 6.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the mac80211 subsystem where a 320 MHz channel bandwidth indication from a received CSA frame on a non-6 GHz link is not properly rejected. This leads to an uninitialized variable being read, which can cause a kernel panic if panic_on_warn is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and requires kernel-level detection. There are no direct network or system commands to detect this issue as it involves kernel panic conditions triggered by invalid CSA frames. Monitoring kernel logs for warnings related to channel width or mac80211 operations may indicate exploitation attempts.

Impact Analysis

This vulnerability could cause a system crash (kernel panic) if an attacker sends a maliciously crafted CSA frame. This may lead to denial of service, disrupting network connectivity or other services relying on the affected system.

Mitigation Strategies

Apply the latest kernel patches or updates that address this issue. If using a vulnerable kernel version, avoid enabling panic_on_warn to prevent kernel crashes. Monitor for unusual wireless frame activity and restrict access to trusted networks until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart