CVE-2026-98337

A flaw was found in the Linux kernel's mac80211 wireless subsystem that Red Hat rates as Low impact. A race condition allows a local user with privileges to issue wireless configuration commands (scanning and remain-on-channel requests via nl80211 require CAP_NET_ADMIN) to add a new remain-on-channel (ROC) request to the ROC list while a wireless scan is concurrently in progress, even though a scan requires that list to be empty. The resulting improper state handling triggers a kernel WARNING in ieee80211_start_next_roc (net/mac80211/offchannel.c), which can disrupt wireless operation and, on systems configured with panic_on_warn, can crash the kernel and cause a local denial of service. No confidentiality or integrity impact is supported by the affected code path, and triggering the race requires precise timing in addition to local privileged access.

The kernel in Red Hat Enterprise Linux 8, 9, and 10, the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels used by OpenShift Container Platform 4 and 5 are affected, with the fix deferred to a future planned update because the issue is a timing-dependent race of low severity whose exploitation requires a local privileged user and whose impact is limited to availability. The residual risk until the fix is delivered is a kernel warning or, on panic_on_warn systems, a locally triggered system crash. The Red Hat Enterprise Linux 7 kernel and kernel-rt are not affected because the vulnerable code is not present in those releases, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support and not scheduled to receive a fix.