CVE-2026-98702
Description
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A nearby wireless attacker can cause a Denial of Service (DoS) by sending a crafted Channel Switch Announcement (CSA) frame with an unsupported bandwidth configuration. Because the kernel fails to reject this channel definition, it reads uninitialized memory and can trigger a system crash.
Statement
An invalid 320 MHz bandwidth indication in a received CSA frame on a non 6 GHz WiFi link can leave vht_operation.chan_width uninitialized before it is read by ieee80211_chandef_vht_oper(). With panic_on_warn enabled the WARN_ON in this path can immediately panic the kernel and cause a denial of service. For the CVSS the PR:N value is used because no account or privileges on the target are required to transmit the wireless frame. The attack is adjacent rather than general network remote because the attacker must be within radio reach and the target must process the crafted CSA frame in a suitable link state. The demonstrated impact is availability loss only. There is no supported UAF OOB access information disclosure or write primitive that would justify confidentiality or integrity impact.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Adjacent Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
