CVE-2026-98325
Description
A flaw was found in the Linux kernel's mac80211 wireless subsystem. Transmission control information within packet buffers was not initialized early enough, preventing proper cleanup and error reporting if header construction or buffer resizing fails. A local user could exploit this flaw during network packet transmission to cause improper resource release, potentially leading to a Denial of Service (DoS).
Statement
A low impact flaw was found in the Linux kernel's mac80211 wireless subsystem as shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform (via the RHEL CoreOS kernel). Transmission control information in socket buffers (skb->cb) was initialized too late, so when frame header construction (ieee80211_build_hdr) or socket-buffer resizing (ieee80211_skb_resize) fails, the failed SKB is not released through the proper cleanup path and the failure is not reported to userspace. A local user able to transmit network traffic through the wireless stack could trigger these error paths to cause improper resource release, leading to a limited denial of service. The flaw is not remotely triggerable by ordinary received Wi-Fi traffic and involves no memory corruption, privilege escalation, or confidentiality or integrity impact. Although the CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact as Low because exploitation requires local access and depends on reaching uncommon error paths such as allocation failures, limiting the practical availability impact. Fixes for the affected product streams are currently deferred; given the local attack vector, the low likelihood of triggering the affected failure paths, and the limited availability impact, the residual risk of deferring is low.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
