In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211_start_ap() can set enable_beacon (and beacon_int) and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00 Call Trace: drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160 __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519 ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193 cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538 in hwsim. Also, cfg80211 then allows changing the interface type, and the off-channel path getgs confused about beaconing as well, leading to another warning: WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122 ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline] __ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882 Reset the state on failures to always have it correct.

A flaw was found in the Linux kernel's mac80211 wireless subsystem. When starting a wireless Access Point (AP) fails after setting beacon parameters, the kernel does not properly reset its internal state. A local attacker can exploit this condition by triggering subsequent scanning operations on the affected interface, resulting in a system crash and a Denial of Service (DoS).

A flaw with low impact was found in the Linux kernel's mac80211 wireless subsystem. When ieee80211_start_ap() fails after setting beacon parameters such as enable_beacon and beacon_int, the error path does not reset this state. A local attacker with the privileges required to configure wireless interfaces (CAP_NET_ADMIN) could then trigger scanning or off-channel operations on such an interface, causing the kernel to attempt to restore beaconing from inconsistent state, leading to a divide error (kernel oops) and a denial of service. Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform RHEL CoreOS 8 and 9 images are recorded as affected with the fix deferred: because exploitation requires local privileged wireless configuration access and the consequence is limited to loss of availability, the fix is deferred to a future scheduled kernel update, and the residual risk is a local denial of service only. The Red Hat impact rating of low is lower than the CVSS 3.1 moderate severity (score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because triggering the flaw requires local privileged access and there is no confidentiality or integrity impact. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Fix deferred kernel Red Hat Enterprise Linux 7 Fix deferred kernel-rt Red Hat Enterprise Linux 8 Fix deferred kernel Red Hat Enterprise Linux 8 Fix deferred kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98334 https://nvd.nist.gov/vuln/detail/CVE-2026-98334 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98334.mbox