CVE-2026-98421

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98421", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.348Z", "datePublished": "2026-10-14T13:27:50.200Z", "dateUpdated": "2026-10-19T09:19:14.905Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:19:14.905Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: require a peer station for TDLS setup confirm\n\nIt's nonsense for the setup confirm to go to station that\ndoesn't even exist, and it hits a warning when building\nthe frame:\n\n WARN_ON_ONCE(!sta || !ap_sta)\n\nOnly accept WLAN_TDLS_SETUP_CONFIRM when the station is\nalready there as a TDLS station. Need to copy the call\nto ieee80211_tdls_prep_mgmt_packet() since the existing\nWLAN_TDLS_DISCOVERY_REQUEST already falls through to it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/tdls.c"], "versions": [{"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "lessThan": "6bae6ef511a29ef12ab969adeea691067d4d5d74", "status": "affected", "versionType": "git"}, {"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "lessThan": "d0afa5395c46d73ad2090aa50209886e84f179bd", "status": "affected", "versionType": "git"}, {"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "lessThan": "742c762bee59c973684f70dfed7de4945d3141e2", "status": "affected", "versionType": "git"}, {"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "lessThan": "fce36d242a18ddf64731d816a37564103172da11", "status": "affected", "versionType": "git"}, {"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "lessThan": "1c0a5c96473b9e7a5f4c453ef6a13dc0f5589a4b", "status": "affected", "versionType": "git"}, {"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "lessThan": "038e1d126304fd25d507fd4e671232df57bd1799", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/tdls.c"], "versions": [{"version": "3.17", "status": "affected"}, {"version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6bae6ef511a29ef12ab969adeea691067d4d5d74"}, {"url": "https://git.kernel.org/stable/c/d0afa5395c46d73ad2090aa50209886e84f179bd"}, {"url": "https://git.kernel.org/stable/c/742c762bee59c973684f70dfed7de4945d3141e2"}, {"url": "https://git.kernel.org/stable/c/fce36d242a18ddf64731d816a37564103172da11"}, {"url": "https://git.kernel.org/stable/c/1c0a5c96473b9e7a5f4c453ef6a13dc0f5589a4b"}, {"url": "https://git.kernel.org/stable/c/038e1d126304fd25d507fd4e671232df57bd1799"}], "title": "wifi: mac80211: require a peer station for TDLS setup confirm", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/tdls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6bae6ef511a29ef12ab969adeea691067d4d5d74", "status": "affected", "version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "versionType": "git"}, {"lessThan": "d0afa5395c46d73ad2090aa50209886e84f179bd", "status": "affected", "version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "versionType": "git"}, {"lessThan": "742c762bee59c973684f70dfed7de4945d3141e2", "status": "affected", "version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "versionType": "git"}, {"lessThan": "fce36d242a18ddf64731d816a37564103172da11", "status": "affected", "version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "versionType": "git"}, {"lessThan": "1c0a5c96473b9e7a5f4c453ef6a13dc0f5589a4b", "status": "affected", "version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "versionType": "git"}, {"lessThan": "038e1d126304fd25d507fd4e671232df57bd1799", "status": "affected", "version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/tdls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"lessThan": "3.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: require a peer station for TDLS setup confirm\n\nIt's nonsense for the setup confirm to go to station that\ndoesn't even exist, and it hits a warning when building\nthe frame:\n\n WARN_ON_ONCE(!sta || !ap_sta)\n\nOnly accept WLAN_TDLS_SETUP_CONFIRM when the station is\nalready there as a TDLS station. Need to copy the call\nto ieee80211_tdls_prep_mgmt_packet() since the existing\nWLAN_TDLS_DISCOVERY_REQUEST already falls through to it."}], "id": "CVE-2026-98421", "lastModified": "2026-10-19T10:18:47.663", "metrics": {}, "published": "2026-10-14T14:17:53.573", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/038e1d126304fd25d507fd4e671232df57bd1799"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c0a5c96473b9e7a5f4c453ef6a13dc0f5589a4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6bae6ef511a29ef12ab969adeea691067d4d5d74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/742c762bee59c973684f70dfed7de4945d3141e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0afa5395c46d73ad2090aa50209886e84f179bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fce36d242a18ddf64731d816a37564103172da11"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mac80211: require a peer station for TDLS setup confirm", "id": "2552196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552196"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: require a peer station for TDLS setup confirm\nIt's nonsense for the setup confirm to go to station that\ndoesn't even exist, and it hits a warning when building\nthe frame:\nWARN_ON_ONCE(!sta || !ap_sta)\nOnly accept WLAN_TDLS_SETUP_CONFIRM when the station is\nalready there as a TDLS station. Need to copy the call\nto ieee80211_tdls_prep_mgmt_packet() since the existing\nWLAN_TDLS_DISCOVERY_REQUEST already falls through to it.", "A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can cause a denial of service (DoS) by requesting a Tunneled Direct Link Setup (TDLS) setup confirmation for a nonexistent peer station. Because the subsystem does not verify that the peer station exists before preparing the management frame, this issue triggers an internal kernel warning that may result in system instability or a crash."], "name": "CVE-2026-98421", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98421\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98421\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98421.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f7eaa47e1de30159277f91f1145a6687f13ffd9,6bae6ef511a29ef12ab969adeea691067d4d5d74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f7eaa47e1de30159277f91f1145a6687f13ffd9,d0afa5395c46d73ad2090aa50209886e84f179bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f7eaa47e1de30159277f91f1145a6687f13ffd9,742c762bee59c973684f70dfed7de4945d3141e2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f7eaa47e1de30159277f91f1145a6687f13ffd9,fce36d242a18ddf64731d816a37564103172da11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f7eaa47e1de30159277f91f1145a6687f13ffd9,1c0a5c96473b9e7a5f4c453ef6a13dc0f5589a4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6f7eaa47e1de30159277f91f1145a6687f13ffd9,038e1d126304fd25d507fd4e671232df57bd1799)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-15T03:30:03.250131+00:00", "updated": "2026-10-19T18:00:02.390408+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}