CVE-2026-98824
Received Received - Intake

Out-of-Bounds Access in Linux Kernel mac80211 TX Status

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrel_ht rate tables. The existing validation only checked that an entry was present and had tries recorded; it did not check that the reported MCS, spatial stream count and bandwidth are representable by the tables, so malformed metadata passed to minstrel_ht_get_stats() or minstrel_ht_ri_get_stats() could be used as an out-of-bounds index. Validate the rate metadata in the common TX status path instead of only in minstrel_ht, since the values are used by more than rate control. The legacy ieee80211_tx_rate array and the rate_info based entries are sanitized in ieee80211_tx_status_ext() and ieee80211_tx_rate_update() before any consumer runs: an entry that does not describe a valid rate for its encoding is dropped. minstrel_ht keeps the checks that depend on its own tables, i.e. the supported number of spatial streams, the MCS group size and the supported bandwidths. This does not take away the driver's responsibility to report sane values, it only prevents a single bad report from corrupting mac80211 state. No WARN_ON() is added: with panic_on_warn a driver bug would otherwise turn into a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98824
EUVD
EUVD-2026-103764

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux a5f69d94d8e239b48299abdd836840b7447866ab
Linux Linux a5f69d94d8e239b48299abdd836840b7447866ab
Linux Linux 3.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of TX status rate metadata in the mac80211 subsystem. The issue occurs in minstrel_ht_tx_status(), where rate metadata is converted into indices for rate tables without proper validation. Malformed metadata could lead to out-of-bounds array access, potentially corrupting kernel state.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related warnings or errors, particularly around wireless driver operations. Use commands like dmesg | grep mac80211 or journalctl -k | grep mac80211 to review kernel messages for anomalies.

Impact Analysis

This vulnerability could allow a malicious actor with local network access to trigger kernel memory corruption via crafted Wi-Fi frames. This may result in system crashes, privilege escalation, or denial of service on affected Linux systems using the mac80211 subsystem.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that includes the fix for CVE-2026-98824. Check your distribution's security updates and apply them promptly. If updating is not immediately possible, consider disabling vulnerable wireless drivers or restricting network access until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart