CVE-2026-98958

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98958", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.382Z", "datePublished": "2026-10-23T12:19:26.256Z", "dateUpdated": "2026-10-23T12:19:26.256Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:19:26.256Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: account non-AQL frames per peer rather than per link\n\nThe driver increments wcid->non_aql_packets when a frame goes to the\nhardware queue. The completion path decrements the counter again.\n\nFor an MLO peer, the hardware reports the completion on the link that it\nused for the transmission. This link can differ from the link that the\ndriver queued the frame on. In that case, the increment and the\ndecrement go to different link wcids, and the count drifts upwards until\nit blocks the station.\n\nKeep the count on the wcid of the primary link, like the other peer-wide\nstate."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt76.h", "drivers/net/wireless/mediatek/mt76/tx.c"], "versions": [{"version": "86c051f2c418abd7eefd8c545a01bdffd220cb95", "lessThan": "9f28f504650869d41f7b3e98e4bc4547af4d5670", "status": "affected", "versionType": "git"}, {"version": "86c051f2c418abd7eefd8c545a01bdffd220cb95", "lessThan": "e0f2ae4a7539454ec50c353571779fcda8c0cfcf", "status": "affected", "versionType": "git"}, {"version": "86c051f2c418abd7eefd8c545a01bdffd220cb95", "lessThan": "752770d7a58c821c17909c3ca67f9f14ab146a40", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt76.h", "drivers/net/wireless/mediatek/mt76/tx.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9f28f504650869d41f7b3e98e4bc4547af4d5670"}, {"url": "https://git.kernel.org/stable/c/e0f2ae4a7539454ec50c353571779fcda8c0cfcf"}, {"url": "https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40"}], "title": "wifi: mt76: account non-AQL frames per peer rather than per link", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt76.h", "drivers/net/wireless/mediatek/mt76/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9f28f504650869d41f7b3e98e4bc4547af4d5670", "status": "affected", "version": "86c051f2c418abd7eefd8c545a01bdffd220cb95", "versionType": "git"}, {"lessThan": "e0f2ae4a7539454ec50c353571779fcda8c0cfcf", "status": "affected", "version": "86c051f2c418abd7eefd8c545a01bdffd220cb95", "versionType": "git"}, {"lessThan": "752770d7a58c821c17909c3ca67f9f14ab146a40", "status": "affected", "version": "86c051f2c418abd7eefd8c545a01bdffd220cb95", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/mediatek/mt76/mt76.h", "drivers/net/wireless/mediatek/mt76/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: account non-AQL frames per peer rather than per link\n\nThe driver increments wcid->non_aql_packets when a frame goes to the\nhardware queue. The completion path decrements the counter again.\n\nFor an MLO peer, the hardware reports the completion on the link that it\nused for the transmission. This link can differ from the link that the\ndriver queued the frame on. In that case, the increment and the\ndecrement go to different link wcids, and the count drifts upwards until\nit blocks the station.\n\nKeep the count on the wcid of the primary link, like the other peer-wide\nstate."}], "id": "CVE-2026-98958", "lastModified": "2026-10-23T13:17:17.120", "metrics": {}, "published": "2026-10-23T13:17:17.120", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/752770d7a58c821c17909c3ca67f9f14ab146a40"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f28f504650869d41f7b3e98e4bc4547af4d5670"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0f2ae4a7539454ec50c353571779fcda8c0cfcf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mt76: account non-AQL frames per peer rather than per link", "id": "2559630", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559630"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mt76: account non-AQL frames per peer rather than per link\nThe driver increments wcid->non_aql_packets when a frame goes to the\nhardware queue. The completion path decrements the counter again.\nFor an MLO peer, the hardware reports the completion on the link that it\nused for the transmission. This link can differ from the link that the\ndriver queued the frame on. In that case, the increment and the\ndecrement go to different link wcids, and the count drifts upwards until\nit blocks the station.\nKeep the count on the wcid of the primary link, like the other peer-wide\nstate.", "A flaw was found in the Linux kernel's mt76 wireless driver. When handling connections that use Multi-Link Operation (MLO), transmission completions can be reported on a different wireless link than the one where packets were initially queued, causing packet accounting counters to drift upward incorrectly. This issue can block network packet transmission, allowing an adjacent network participant or peer traffic to cause a Denial of Service (DoS) for the wireless station."], "name": "CVE-2026-98958", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98958\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98958\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98958.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86c051f2c418abd7eefd8c545a01bdffd220cb95,9f28f504650869d41f7b3e98e4bc4547af4d5670)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86c051f2c418abd7eefd8c545a01bdffd220cb95,e0f2ae4a7539454ec50c353571779fcda8c0cfcf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86c051f2c418abd7eefd8c545a01bdffd220cb95,752770d7a58c821c17909c3ca67f9f14ab146a40)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86c051f2c418abd7eefd8c545a01bdffd220cb95,9f28f504650869d41f7b3e98e4bc4547af4d5670)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86c051f2c418abd7eefd8c545a01bdffd220cb95,e0f2ae4a7539454ec50c353571779fcda8c0cfcf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86c051f2c418abd7eefd8c545a01bdffd220cb95,752770d7a58c821c17909c3ca67f9f14ab146a40)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:15:07.226495+00:00", "updated": "2026-10-29T20:15:14.762074+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}