CVE-2026-98334
Description
A flaw was found in the Linux kernel's mac80211 wireless subsystem. When starting a wireless Access Point (AP) fails after setting beacon parameters, the kernel does not properly reset its internal state. A local attacker can exploit this condition by triggering subsequent scanning operations on the affected interface, resulting in a system crash and a Denial of Service (DoS).
Statement
A flaw with low impact was found in the Linux kernel's mac80211 wireless subsystem. When ieee80211_start_ap() fails after setting beacon parameters such as enable_beacon and beacon_int, the error path does not reset this state. A local attacker with the privileges required to configure wireless interfaces (CAP_NET_ADMIN) could then trigger scanning or off-channel operations on such an interface, causing the kernel to attempt to restore beaconing from inconsistent state, leading to a divide error (kernel oops) and a denial of service. Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform RHEL CoreOS 8 and 9 images are recorded as affected with the fix deferred: because exploitation requires local privileged wireless configuration access and the consequence is limited to loss of availability, the fix is deferred to a future scheduled kernel update, and the residual risk is a local denial of service only. The Red Hat impact rating of low is lower than the CVSS 3.1 moderate severity (score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because triggering the flaw requires local privileged access and there is no confidentiality or integrity impact.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
A Divide by Zero results in a crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
