CVE-2026-98182

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98182", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.323Z", "datePublished": "2026-10-06T08:44:25.219Z", "dateUpdated": "2026-10-19T09:15:13.449Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:15:13.449Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: refuse to make a monitor active when it has no queue\n\nA monitor interface only gets a TXQ if it's created active, and one can't\nbe added later. Setting the flag on a down interface is still allowed, so\nthe driver is handed a monitor with no queue. ath9k dereferences it:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000066\n RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]\n ath9k_add_interface+0x10c/0x140 [ath9k]\n drv_add_interface+0x54/0x250 [mac80211]\n ieee80211_do_open+0x32f/0x800 [mac80211]\n\nReached with CAP_NET_ADMIN by \"iw dev X set monitor active\" followed by\n\"ip link set X up\". RTNL is held, so netlink operations block behind it.\n\nRefuse the flag when there is no queue to give."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/cfg.c"], "versions": [{"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "lessThan": "b7b7d46ec4fa127767931938b282c361c0519af6", "status": "affected", "versionType": "git"}, {"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "lessThan": "abe15e643e576459469867758ae9c586a7bab95d", "status": "affected", "versionType": "git"}, {"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "lessThan": "46c223468537a05a404699771cd3e68532dab5e6", "status": "affected", "versionType": "git"}, {"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "lessThan": "2b04d6556964ae9f89819b86a0a7801e39c3aae5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/cfg.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b7b7d46ec4fa127767931938b282c361c0519af6"}, {"url": "https://git.kernel.org/stable/c/abe15e643e576459469867758ae9c586a7bab95d"}, {"url": "https://git.kernel.org/stable/c/46c223468537a05a404699771cd3e68532dab5e6"}, {"url": "https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"}], "title": "wifi: mac80211: refuse to make a monitor active when it has no queue", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/cfg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b7b7d46ec4fa127767931938b282c361c0519af6", "status": "affected", "version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "versionType": "git"}, {"lessThan": "abe15e643e576459469867758ae9c586a7bab95d", "status": "affected", "version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "versionType": "git"}, {"lessThan": "46c223468537a05a404699771cd3e68532dab5e6", "status": "affected", "version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "versionType": "git"}, {"lessThan": "2b04d6556964ae9f89819b86a0a7801e39c3aae5", "status": "affected", "version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/cfg.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: refuse to make a monitor active when it has no queue\n\nA monitor interface only gets a TXQ if it's created active, and one can't\nbe added later. Setting the flag on a down interface is still allowed, so\nthe driver is handed a monitor with no queue. ath9k dereferences it:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000066\n RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]\n ath9k_add_interface+0x10c/0x140 [ath9k]\n drv_add_interface+0x54/0x250 [mac80211]\n ieee80211_do_open+0x32f/0x800 [mac80211]\n\nReached with CAP_NET_ADMIN by \"iw dev X set monitor active\" followed by\n\"ip link set X up\". RTNL is held, so netlink operations block behind it.\n\nRefuse the flag when there is no queue to give."}], "id": "CVE-2026-98182", "lastModified": "2026-10-19T10:18:18.537", "metrics": {}, "published": "2026-10-06T09:18:02.967", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46c223468537a05a404699771cd3e68532dab5e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abe15e643e576459469867758ae9c586a7bab95d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7b7d46ec4fa127767931938b282c361c0519af6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mac80211: refuse to make a monitor active when it has no queue", "id": "2546359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546359"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user with network administration privileges can cause a Denial of Service (DoS) by configuring an inactive network interface to active monitor mode and then bringing the interface up. Because the required transmit queue is not allocated when the flag is set on a down interface, the wireless driver triggers a null pointer dereference, leading to a kernel crash."], "name": "CVE-2026-98182", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98182\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98182\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98182.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[79af1f866193de29e65a4dba7d0dab14b0c0ff93,b7b7d46ec4fa127767931938b282c361c0519af6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[79af1f866193de29e65a4dba7d0dab14b0c0ff93,abe15e643e576459469867758ae9c586a7bab95d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[79af1f866193de29e65a4dba7d0dab14b0c0ff93,46c223468537a05a404699771cd3e68532dab5e6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[79af1f866193de29e65a4dba7d0dab14b0c0ff93,2b04d6556964ae9f89819b86a0a7801e39c3aae5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T15:00:18.392474+00:00", "updated": "2026-10-09T04:00:17.906137+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}