CVE-2026-98698

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98698", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.365Z", "datePublished": "2026-10-18T15:46:23.363Z", "dateUpdated": "2026-10-30T12:38:50.641Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:50.641Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: handle empty FILS association request payload\n\nfils_encrypt_assoc_req() accepts a (Re)Association Request frame whose\nlast element is the FILS Session element. crypt_len is then zero and\naes_siv_encrypt() is called with an empty plaintext.\n\nkmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the\nunconditional sg_init_one() puts an invalid page into the scatterlist.\nWith CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf();\nwithout the debug check the bogus page is handed to the crypto backend.\n\nAES-SIV is defined for empty plaintext and the S2V result is then the\ncomplete output, so handle this case before the CTR step, which has\nnothing to encrypt."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/fils_aead.c"], "versions": [{"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "de3297c8e521c0b0ddc89ece6fee84e25da9ecf0", "status": "affected", "versionType": "git"}, {"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "ce70c87252a14020cb40032efe208efc6e61b1ee", "status": "affected", "versionType": "git"}, {"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "d8c5dbbf584a1baaa008988ac64dd4495f7086bd", "status": "affected", "versionType": "git"}, {"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "0b1e4a7eeb6a301ee33bd318982927cbdbae9f36", "status": "affected", "versionType": "git"}, {"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "2f5b62f6534d336a62fdb9e88b186dd70b4323ef", "status": "affected", "versionType": "git"}, {"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "452f1c9b76f7a122bbc4630b9691bda4809677c4", "status": "affected", "versionType": "git"}, {"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "20f939b0c151d1d28e6b62a76b2454fa6fe877f2", "status": "affected", "versionType": "git"}, {"version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "lessThan": "5bfd4b0b40b79781d900cb2f7da0685070f53c67", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/fils_aead.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/de3297c8e521c0b0ddc89ece6fee84e25da9ecf0"}, {"url": "https://git.kernel.org/stable/c/ce70c87252a14020cb40032efe208efc6e61b1ee"}, {"url": "https://git.kernel.org/stable/c/d8c5dbbf584a1baaa008988ac64dd4495f7086bd"}, {"url": "https://git.kernel.org/stable/c/0b1e4a7eeb6a301ee33bd318982927cbdbae9f36"}, {"url": "https://git.kernel.org/stable/c/2f5b62f6534d336a62fdb9e88b186dd70b4323ef"}, {"url": "https://git.kernel.org/stable/c/452f1c9b76f7a122bbc4630b9691bda4809677c4"}, {"url": "https://git.kernel.org/stable/c/20f939b0c151d1d28e6b62a76b2454fa6fe877f2"}, {"url": "https://git.kernel.org/stable/c/5bfd4b0b40b79781d900cb2f7da0685070f53c67"}], "title": "wifi: mac80211: handle empty FILS association request payload", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/fils_aead.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "de3297c8e521c0b0ddc89ece6fee84e25da9ecf0", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}, {"lessThan": "ce70c87252a14020cb40032efe208efc6e61b1ee", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}, {"lessThan": "d8c5dbbf584a1baaa008988ac64dd4495f7086bd", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}, {"lessThan": "0b1e4a7eeb6a301ee33bd318982927cbdbae9f36", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}, {"lessThan": "2f5b62f6534d336a62fdb9e88b186dd70b4323ef", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}, {"lessThan": "452f1c9b76f7a122bbc4630b9691bda4809677c4", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}, {"lessThan": "20f939b0c151d1d28e6b62a76b2454fa6fe877f2", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}, {"lessThan": "5bfd4b0b40b79781d900cb2f7da0685070f53c67", "status": "affected", "version": "39404feee691a2dc524a629ed6eb5cfe5d8898d1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/fils_aead.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: handle empty FILS association request payload\n\nfils_encrypt_assoc_req() accepts a (Re)Association Request frame whose\nlast element is the FILS Session element. crypt_len is then zero and\naes_siv_encrypt() is called with an empty plaintext.\n\nkmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the\nunconditional sg_init_one() puts an invalid page into the scatterlist.\nWith CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf();\nwithout the debug check the bogus page is handed to the crypto backend.\n\nAES-SIV is defined for empty plaintext and the S2V result is then the\ncomplete output, so handle this case before the CTR step, which has\nnothing to encrypt."}], "id": "CVE-2026-98698", "lastModified": "2026-10-30T13:21:19.020", "metrics": {}, "published": "2026-10-18T16:17:23.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b1e4a7eeb6a301ee33bd318982927cbdbae9f36"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20f939b0c151d1d28e6b62a76b2454fa6fe877f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f5b62f6534d336a62fdb9e88b186dd70b4323ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/452f1c9b76f7a122bbc4630b9691bda4809677c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5bfd4b0b40b79781d900cb2f7da0685070f53c67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce70c87252a14020cb40032efe208efc6e61b1ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d8c5dbbf584a1baaa008988ac64dd4495f7086bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de3297c8e521c0b0ddc89ece6fee84e25da9ecf0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mac80211: handle empty FILS association request payload", "id": "2555057", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555057"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: handle empty FILS association request payload\nfils_encrypt_assoc_req() accepts a (Re)Association Request frame whose\nlast element is the FILS Session element. crypt_len is then zero and\naes_siv_encrypt() is called with an empty plaintext.\nkmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the\nunconditional sg_init_one() puts an invalid page into the scatterlist.\nWith CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf();\nwithout the debug check the bogus page is handed to the crypto backend.\nAES-SIV is defined for empty plaintext and the S2V result is then the\ncomplete output, so handle this case before the CTR step, which has\nnothing to encrypt.", "A flaw was found in the Linux kernel's mac80211 wireless subsystem. When handling a Fast Initial Link Setup (FILS) association request frame with an empty payload, the system fails to validate zero-length plaintext before cryptographic processing. This issue causes an invalid memory reference to be passed to the encryption backend, which can trigger a kernel crash. An adjacent attacker within Wi-Fi range could exploit this vulnerability to cause a Denial of Service (DoS)."], "name": "CVE-2026-98698", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98698\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98698\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98698.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39404feee691a2dc524a629ed6eb5cfe5d8898d1,2f5b62f6534d336a62fdb9e88b186dd70b4323ef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39404feee691a2dc524a629ed6eb5cfe5d8898d1,452f1c9b76f7a122bbc4630b9691bda4809677c4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39404feee691a2dc524a629ed6eb5cfe5d8898d1,20f939b0c151d1d28e6b62a76b2454fa6fe877f2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[39404feee691a2dc524a629ed6eb5cfe5d8898d1,5bfd4b0b40b79781d900cb2f7da0685070f53c67)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:00:12.043143+00:00", "updated": "2026-10-22T20:45:05.396000+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-665", "CWE-617"]}