CVE-2026-97518

A moderate severity flaw was found in the Linux kernel's cfg80211 wireless configuration subsystem as shipped in Red Hat Enterprise Linux (including the kernel-rt variant), Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. The cfg80211 subsystem did not reject duplicate cipher suite entries supplied by a wireless driver when registering a wiphy device. In the Wireless Extensions (WEXT) compatibility layer, the SIOCGIWRANGE ioctl appends a WEP key length for each WEP cipher suite entry it encounters, so repeated WEP entries can overflow the fixed iw_range::encoding_size array, resulting in kernel memory corruption and a denial of service via a system crash. A local user who queries wireless capabilities through this ioctl can trigger the overflow; however, exploitation requires a wireless driver that registers a malformed wiphy description containing duplicate cipher suites, which limits practical exposure, and Red Hat rates this flaw Moderate (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The fix is currently deferred for the affected Red Hat products: the flaw is not remotely reachable and requires an unusual malformed driver configuration, so it will be addressed in a future scheduled update rather than an immediate erratum. The residual risk until the fix is delivered is local denial of service or memory corruption on systems where an affected wireless driver is loaded.