CVE-2026-98406
Description
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can trigger a denial of service (DoS) condition by issuing a wireless bitrate configuration request while a network interface is undergoing initialization or teardown. Because the subsystem fails to verify that the interface is actively attached to the underlying driver, processing the request triggers an internal kernel warning that can lead to system instability.
Statement
A flaw of low impact was found in the Linux kernel's mac80211 wireless subsystem, which affects the kernels shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform (via RHEL CoreOS). A local attacker with the ability to issue wireless extension ioctls can trigger a denial of service by sending an SIOCSIWRATE bitrate-configuration request while a wireless interface is running but not yet (or no longer) registered with its driver, for example during interface bringup or teardown. Because ieee80211_set_bitrate_mask() does not verify that the interface is present in the driver, the request reaches drv_set_bitrate_mask() and triggers a WARN_ONCE assertion, which can cause system instability or a kernel panic on systems configured to panic on warnings. Confidentiality and integrity are not affected. Red Hat rates the impact of this flaw as low because the direct effect is a kernel warning and a crash requires the non-default panic_on_warn configuration, which is lower than the severity implied by the maximum-availability CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5 Moderate). Fixes for the affected Red Hat products are currently deferred to future updates; the residual risk is limited to local denial of service by an attacker who already has local access and the privileges needed to issue wireless configuration ioctls.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
