CVE-2026-98345

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98345", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.343Z", "datePublished": "2026-10-06T08:46:34.719Z", "dateUpdated": "2026-10-19T09:17:56.221Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:56.221Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check IP header size in cfg80211_classify8021d()\n\nA frame that looks like IP can be transmitted, but be too short, so\nthe DS field is read incorrectly:\n\n BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180\n __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304\n ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538\n ...\n packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108\n\nUse skb_header_pointer() like the MPLS case."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/util.c"], "versions": [{"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "18d5547327c202cda33ad2bbd203220c2c62c8a7", "status": "affected", "versionType": "git"}, {"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734", "status": "affected", "versionType": "git"}, {"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7", "status": "affected", "versionType": "git"}, {"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "12c0abd4d1c1b04a7663d04ba85268bc9ad9c017", "status": "affected", "versionType": "git"}, {"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "f33ad4e2f846e55cf4637419268f093ac9f1a765", "status": "affected", "versionType": "git"}, {"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "a2cdb4a675ca04c4ac8cc962848082d8ce065008", "status": "affected", "versionType": "git"}, {"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "65893c8d28f239c7ddad5a83683be193a9133e9b", "status": "affected", "versionType": "git"}, {"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "lessThan": "48b2c5c628b09cf36cbeca53e0432fc2a7518be7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/util.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/18d5547327c202cda33ad2bbd203220c2c62c8a7"}, {"url": "https://git.kernel.org/stable/c/3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734"}, {"url": "https://git.kernel.org/stable/c/c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7"}, {"url": "https://git.kernel.org/stable/c/12c0abd4d1c1b04a7663d04ba85268bc9ad9c017"}, {"url": "https://git.kernel.org/stable/c/f33ad4e2f846e55cf4637419268f093ac9f1a765"}, {"url": "https://git.kernel.org/stable/c/a2cdb4a675ca04c4ac8cc962848082d8ce065008"}, {"url": "https://git.kernel.org/stable/c/65893c8d28f239c7ddad5a83683be193a9133e9b"}, {"url": "https://git.kernel.org/stable/c/48b2c5c628b09cf36cbeca53e0432fc2a7518be7"}], "title": "wifi: cfg80211: check IP header size in cfg80211_classify8021d()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "18d5547327c202cda33ad2bbd203220c2c62c8a7", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}, {"lessThan": "3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}, {"lessThan": "c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}, {"lessThan": "12c0abd4d1c1b04a7663d04ba85268bc9ad9c017", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}, {"lessThan": "f33ad4e2f846e55cf4637419268f093ac9f1a765", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}, {"lessThan": "a2cdb4a675ca04c4ac8cc962848082d8ce065008", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}, {"lessThan": "65893c8d28f239c7ddad5a83683be193a9133e9b", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}, {"lessThan": "48b2c5c628b09cf36cbeca53e0432fc2a7518be7", "status": "affected", "version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/util.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check IP header size in cfg80211_classify8021d()\n\nA frame that looks like IP can be transmitted, but be too short, so\nthe DS field is read incorrectly:\n\n BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180\n __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304\n ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538\n ...\n packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108\n\nUse skb_header_pointer() like the MPLS case."}], "id": "CVE-2026-98345", "lastModified": "2026-10-19T10:18:36.957", "metrics": {}, "published": "2026-10-06T09:18:27.480", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12c0abd4d1c1b04a7663d04ba85268bc9ad9c017"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18d5547327c202cda33ad2bbd203220c2c62c8a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/48b2c5c628b09cf36cbeca53e0432fc2a7518be7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/65893c8d28f239c7ddad5a83683be193a9133e9b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a2cdb4a675ca04c4ac8cc962848082d8ce065008"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f33ad4e2f846e55cf4637419268f093ac9f1a765"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: cfg80211: check IP header size in cfg80211_classify8021d()", "id": "2546502", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546502"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: cfg80211: check IP header size in cfg80211_classify8021d()\nA frame that looks like IP can be transmitted, but be too short, so\nthe DS field is read incorrectly:\nBUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\ncfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\nieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180\n__ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304\nieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538\n...\npacket_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108\nUse skb_header_pointer() like the MPLS case.", "A flaw was found in the Linux kernel's cfg80211 wireless subsystem. A local attacker can cause a Denial of Service (DoS) by transmitting crafted network frames that appear to be Internet Protocol (IP) traffic. Because the kernel fails to verify that the frame is large enough to hold a complete header before reading traffic priority fields, it reads uninitialized memory, potentially crashing the system."], "name": "CVE-2026-98345", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98345\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98345\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98345.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,18d5547327c202cda33ad2bbd203220c2c62c8a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,12c0abd4d1c1b04a7663d04ba85268bc9ad9c017)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,f33ad4e2f846e55cf4637419268f093ac9f1a765)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,a2cdb4a675ca04c4ac8cc962848082d8ce065008)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,65893c8d28f239c7ddad5a83683be193a9133e9b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e31a16d6f64ef0e324c6f54d5112703c3f13a9c4,48b2c5c628b09cf36cbeca53e0432fc2a7518be7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.31"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.31)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T15:15:14.648398+00:00", "updated": "2026-10-11T07:00:09.023530+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}