CVE-2026-98339 (GCVE-0-2026-98339)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6ef87a853327434ae1cd9c5a2c27a557fb4047fc",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "1380ee3a202dbb9f8e8b3c3b87eb410450d57799",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "fb445ec7480da5d2b82bf681e3b4313603722729",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "65fdb973bd905bc3f5cb045a04c1828f2d2a7e24",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "64e23a36d8f04811372365b44cfca325f8e0f4bb",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "0aa44982125c86b47961be5ac1c82eddab8080f3",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "b377e1000d963e7182a987082b4b06580bd7ac84",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t filter by BSS type when removing stale entries\n\nWhen an assoc AP switches to a channel that already has a BSS entry,\ncfg80211_update_assoc_bss_entry() removes that entry before rehashing\nthe real one, since the two would otherwise collide in the BSS rbtree.\n\nThe lookup for that entry also required it to match the connection\u0027s BSS\ntype, so an entry advertising e.g. the IBSS capability bit was left in\nplace, and the following cfg80211_rehash_bss() then ran into it:\n\n  WARN_ON(!cmp)\n\nChanging the type shouldn\u0027t really happen, but can be triggered by a\nrogue AP/device, so drop the check and remove any entries matching\nthe comparison."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bad state comes from received 802.11 frames: a beacon/probe response carrying the associated AP\u0027s BSSID+SSID with the IBSS capability bit on another channel, then a CSA beacon that leads to cfg80211_ch_switch_notify() -\u003e cfg80211_update_assoc_bss_entry(). The attacker must be in WiFi radio range.\nAC:L - The attacker produces every step: injecting the colliding scan entry, sending the CSA (beacons are unprotected without beacon protection), then a second CSA or going silent so connection loss calls cfg80211_unlink_bss(). cmp_bss() ignores capability, so the rb_insert_bss() collision always happens.\nPR:N - No credentials are needed. A rogue AP, or an attacker spoofing management beacons of the victim\u0027s AP, triggers mac80211 channel-switch processing and scan-entry creation before any authenticated data exchange.\nUI:N - The victim station only needs to be in its normal associated state. Beacon/CSA processing and the later beacon-loss unlink happen automatically, with no user action.\nS:U - The corruption is confined to cfg80211\u0027s BSS list and rbtree within the same kernel. There is no hypervisor or other security-authority boundary crossed.\nC:H - After the failed rehash the connected BSS has stale rbn pointers. A second CSA makes cfg80211_rehash_bss() rb_erase() that non-member node, rewriting live parent/child links so bss_tree can reference entries later freed on expiry. That is a use-after-free on every rb lookup triggered by a received beacon.\nI:H - The double rb_erase() of the stale cbss-\u003erbn and the list_del() leaving poisoned pointers on a still-referenced BSS corrupt kernel heap metadata (tree links, bss_entries). The resulting use-after-free of cfg80211_internal_bss objects is a write-capable memory-corruption primitive.\nA:H - After cfg80211_rehash_bss() list_del()s the connected BSS, beacon-loss handling calls cfg80211_unlink_bss() -\u003e __cfg80211_unlink_bss() -\u003e list_del_init() on LIST_POISON pointers and faults (oops/panic). WARN_ON(!cmp) also panics with panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:17:50.299Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729"
        },
        {
          "url": "https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84"
        }
      ],
      "title": "wifi: cfg80211: don\u0027t filter by BSS type when removing stale entries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98339",
    "datePublished": "2026-10-06T08:46:29.998Z",
    "dateReserved": "2026-09-25T10:25:14.342Z",
    "dateUpdated": "2026-10-19T09:17:50.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.