CVE-2026-98702

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98702", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.365Z", "datePublished": "2026-10-18T15:46:32.122Z", "dateUpdated": "2026-10-19T09:24:11.728Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:24:11.728Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject invalid 320 MHz CSA bandwidth\n\nThe HT/VHT channel definition validator can receive a 320 MHz\nbandwidth indication from a received CSA frame on a non-6 GHz link.\nIt warns for this unsupported width but continues with an uninitialized\nvht_operation.chan_width, which is then read by\nieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a\nreceived frame panic the kernel.\n\nReject the channel definition before entering the VHT operation\nconversion. This preserves the existing CSA fallback while avoiding\nboth the warning and the uninitialized read."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/spectmgmt.c"], "versions": [{"version": "21c3f8f95554feff9bed15703e89adbe582e0383", "lessThan": "cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16", "status": "affected", "versionType": "git"}, {"version": "21c3f8f95554feff9bed15703e89adbe582e0383", "lessThan": "1892e71aa2e5ee667d87c6e49e3661f5e290303b", "status": "affected", "versionType": "git"}, {"version": "21c3f8f95554feff9bed15703e89adbe582e0383", "lessThan": "79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c", "status": "affected", "versionType": "git"}, {"version": "21c3f8f95554feff9bed15703e89adbe582e0383", "lessThan": "56e236759f0a8dc910c2ae7cd3c161f298ee5794", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/spectmgmt.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16"}, {"url": "https://git.kernel.org/stable/c/1892e71aa2e5ee667d87c6e49e3661f5e290303b"}, {"url": "https://git.kernel.org/stable/c/79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c"}, {"url": "https://git.kernel.org/stable/c/56e236759f0a8dc910c2ae7cd3c161f298ee5794"}], "title": "wifi: mac80211: reject invalid 320 MHz CSA bandwidth", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/spectmgmt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16", "status": "affected", "version": "21c3f8f95554feff9bed15703e89adbe582e0383", "versionType": "git"}, {"lessThan": "1892e71aa2e5ee667d87c6e49e3661f5e290303b", "status": "affected", "version": "21c3f8f95554feff9bed15703e89adbe582e0383", "versionType": "git"}, {"lessThan": "79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c", "status": "affected", "version": "21c3f8f95554feff9bed15703e89adbe582e0383", "versionType": "git"}, {"lessThan": "56e236759f0a8dc910c2ae7cd3c161f298ee5794", "status": "affected", "version": "21c3f8f95554feff9bed15703e89adbe582e0383", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/spectmgmt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject invalid 320 MHz CSA bandwidth\n\nThe HT/VHT channel definition validator can receive a 320 MHz\nbandwidth indication from a received CSA frame on a non-6 GHz link.\nIt warns for this unsupported width but continues with an uninitialized\nvht_operation.chan_width, which is then read by\nieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a\nreceived frame panic the kernel.\n\nReject the channel definition before entering the VHT operation\nconversion. This preserves the existing CSA fallback while avoiding\nboth the warning and the uninitialized read."}], "id": "CVE-2026-98702", "lastModified": "2026-10-19T10:19:34.500", "metrics": {}, "published": "2026-10-18T16:17:23.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1892e71aa2e5ee667d87c6e49e3661f5e290303b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56e236759f0a8dc910c2ae7cd3c161f298ee5794"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via invalid channel switch frame in mac80211", "id": "2555094", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555094"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: reject invalid 320 MHz CSA bandwidth\nThe HT/VHT channel definition validator can receive a 320 MHz\nbandwidth indication from a received CSA frame on a non-6 GHz link.\nIt warns for this unsupported width but continues with an uninitialized\nvht_operation.chan_width, which is then read by\nieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a\nreceived frame panic the kernel.\nReject the channel definition before entering the VHT operation\nconversion. This preserves the existing CSA fallback while avoiding\nboth the warning and the uninitialized read.", "A flaw was found in the Linux kernel's mac80211 wireless subsystem. A nearby wireless attacker can cause a Denial of Service (DoS) by sending a crafted Channel Switch Announcement (CSA) frame with an unsupported bandwidth configuration. Because the kernel fails to reject this channel definition, it reads uninitialized memory and can trigger a system crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98702", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:46:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98702\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98702\nhttps://git.kernel.org/stable/c/1892e71aa2e5ee667d87c6e49e3661f5e290303b\nhttps://git.kernel.org/stable/c/56e236759f0a8dc910c2ae7cd3c161f298ee5794\nhttps://git.kernel.org/stable/c/79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c\nhttps://git.kernel.org/stable/c/cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16"], "statement": "An invalid 320 MHz bandwidth indication in a received CSA frame on a non 6 GHz WiFi link can leave vht_operation.chan_width uninitialized before it is read by ieee80211_chandef_vht_oper(). With panic_on_warn enabled the WARN_ON in this path can immediately panic the kernel and cause a denial of service. For the CVSS the PR:N value is used because no account or privileges on the target are required to transmit the wireless frame. The attack is adjacent rather than general network remote because the attacker must be within radio reach and the target must process the crafted CSA frame in a suitable link state. The demonstrated impact is availability loss only. There is no supported UAF OOB access information disclosure or write primitive that would justify confidentiality or integrity impact.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[21c3f8f95554feff9bed15703e89adbe582e0383,cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[21c3f8f95554feff9bed15703e89adbe582e0383,1892e71aa2e5ee667d87c6e49e3661f5e290303b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[21c3f8f95554feff9bed15703e89adbe582e0383,79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[21c3f8f95554feff9bed15703e89adbe582e0383,56e236759f0a8dc910c2ae7cd3c161f298ee5794)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:15:14.439761+00:00", "updated": "2026-10-22T21:15:12.496086+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}