CVE-2026-98183

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98183", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.323Z", "datePublished": "2026-10-06T08:44:26.024Z", "dateUpdated": "2026-10-19T09:15:14.410Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:15:14.410Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid out-of-bounds read for empty PREQ elements\n\nieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom\nfields before checking whether the element contains even the fixed\nheader. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to\naccount for the optional Address Extension field. Consequently, an\nempty PREQ element causes a one-byte read beyond its declared payload.\n\nMove the helper call after both size checks, so the bottom fields are\nonly accessed when they are present."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/ieee80211-mesh.h"], "versions": [{"version": "8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae", "lessThan": "3beddbd56946577478fd5e649f556aaaebe15b0a", "status": "affected", "versionType": "git"}, {"version": "8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae", "lessThan": "e6031f02269c0f51cf67886d177f02bc300b47cd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/ieee80211-mesh.h"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3beddbd56946577478fd5e649f556aaaebe15b0a"}, {"url": "https://git.kernel.org/stable/c/e6031f02269c0f51cf67886d177f02bc300b47cd"}], "title": "wifi: mac80211: avoid out-of-bounds read for empty PREQ elements", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/ieee80211-mesh.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3beddbd56946577478fd5e649f556aaaebe15b0a", "status": "affected", "version": "8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae", "versionType": "git"}, {"lessThan": "e6031f02269c0f51cf67886d177f02bc300b47cd", "status": "affected", "version": "8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/ieee80211-mesh.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid out-of-bounds read for empty PREQ elements\n\nieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom\nfields before checking whether the element contains even the fixed\nheader. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to\naccount for the optional Address Extension field. Consequently, an\nempty PREQ element causes a one-byte read beyond its declared payload.\n\nMove the helper call after both size checks, so the bottom fields are\nonly accessed when they are present."}], "id": "CVE-2026-98183", "lastModified": "2026-10-19T10:18:18.630", "metrics": {}, "published": "2026-10-06T09:18:03.103", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3beddbd56946577478fd5e649f556aaaebe15b0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6031f02269c0f51cf67886d177f02bc300b47cd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements", "id": "2546428", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546428"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. An adjacent attacker can trigger an out-of-bounds read by transmitting specially crafted wireless mesh network frames containing empty Path Request (PREQ) elements. This issue occurs because the kernel reads header fields before verifying the element size. Exploitation of this flaw may lead to a denial of service (DoS) or the disclosure of sensitive memory information."], "name": "CVE-2026-98183", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98183\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98183\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98183.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae,3beddbd56946577478fd5e649f556aaaebe15b0a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae,e6031f02269c0f51cf67886d177f02bc300b47cd)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T15:00:18.392332+00:00", "updated": "2026-10-09T03:00:08.055961+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}