CVE-2026-98703
Received Received - Intake

Linux Kernel Array Index Out-of-Bounds in mac80211 minstrel_ht

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel_ht: validate fixed rate index The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->max_prob_rate, and minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries) with it. Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel_rate_stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is reported as an array-index-out-of-bounds in minstrel_ht_set_rate(). Only a valid group/rate pair, or U32_MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written. The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98703
EUVD
EUVD-2026-103957

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 24f7580e852b5472b51eea322bb78454df0054b8
Linux Linux 24f7580e852b5472b51eea322bb78454df0054b8
Linux Linux 24f7580e852b5472b51eea322bb78454df0054b8
Linux Linux 24f7580e852b5472b51eea322bb78454df0054b8
Linux Linux 3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the mac80211 subsystem's minstrel_ht module. It involves a debugfs file called fixed_rate_idx that allows writing arbitrary values. When an invalid value is written, it causes an out-of-bounds array access in kernel memory, corrupting adjacent data structures. The issue arises because the value is used to index arrays without proper validation.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 minstrel_ht module and can only be triggered via a debugfs file that requires root access. Detection involves checking for kernel memory corruption or out-of-bounds access errors in logs. Monitor kernel logs for UBSAN or general protection fault messages after writing to the fixed_rate_idx debugfs file.

Impact Analysis

This vulnerability could lead to kernel memory corruption, potentially causing system crashes or instability. Since the debugfs file is root-only, exploitation requires root access. However, it still represents a security bug that could be chained with other vulnerabilities for privilege escalation.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Ensure debugfs is not mounted with write permissions for untrusted users. Restrict root access to systems where debugfs is mounted. Monitor kernel logs for any signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart