CVE-2026-98338

A low impact race condition was found in the Linux kernel's cfg80211 wireless subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, the Red Hat In-Vehicle OS kernels, and the RHEL CoreOS 8 and RHEL CoreOS 9 kernels shipped with OpenShift Container Platform. When an IBSS (ad-hoc wireless network) is joined, the kernel records only the BSSID/channel in the event and looks up the BSS entry later, when the event is processed on the cfg80211 event workqueue. A local user with privileges to manage wireless configuration could initiate a concurrent scan with NL80211_SCAN_FLAG_FLUSH that removes the BSS entry while the join event is still queued, triggering a kernel WARNING in __cfg80211_ibss_joined and disrupting IBSS join handling. A system crash and denial of service is possible only on systems configured to panic on warnings; no use-after-free or other memory corruption is established in the affected path. The impact was rated Low because exploitation requires local access with administrative network privileges and winning a timing-dependent race, and the realistic consequence is a kernel warning and disruption of IBSS state or connectivity; the CVSS:3.1 score of 5.5 (Moderate) reflects only the upper-bound availability impact. Because of the low impact, fixes for the affected products are deferred to a future scheduled update, and the residual risk is limited to local denial of service on systems that use IBSS ad-hoc wireless networking.